Initial stage of Splunk performance tunning

[rreddy012c]

We have deployed our splunk in our organization. We are currently ingesting 1.7 TB data per day and it can increase up to 3.5 TB. We are using high performance hardware resources for splunk.
Now I would like to know what would be the better tuning memory parameters which need to set for SH/Indexer to increase the performance? Otherthan memory do we need to look into any other settings?

[ddrillic]

Many many aspects are involved. The following can assist - Optimize Splunk for peak performance

[skoelpin]

Depending on the specs of your indexers, you could enable parallelization to increase throughput

http://docs.splunk.com/Documentation/Splunk/6.6.3/Capacity/Parallelization

[rreddy012c]

Thanks for suggestion and How memory does splunk allocates for each search?

[skoelpin]

Splunk cares more about CPU cores than memory. A rule of thumb is each concurrent search represents approx 1 CPU core. This is configurable though

http://docs.splunk.com/Documentation/Splunk/6.1.4/Deploy/Referencehardware