Archive
Highlighted

Recommended Virtual Machine Sizes for Search Head and Indexer

Motivator

Does this seem like a good setup for a dedicated Search head, indexer for a virtualized Splunk?

Search Head
- 8 core 16 GB Ram

Indexer
- 8 core 8 GB Ram 1 TB Hard Drive

We will have approximately 3 concurrent users at a given time, and a throughput of 10 GB/day

Tags (2)
0 Karma
Highlighted

Re: Recommended Virtual Machine Sizes for Search Head and Indexer

SplunkTrust
SplunkTrust

I'd swap the cores around, giving the search head more oomph.

Highlighted

Re: Recommended Virtual Machine Sizes for Search Head and Indexer

Motivator

I have modified my post, does that look much better?

0 Karma
Highlighted

Re: Recommended Virtual Machine Sizes for Search Head and Indexer

Splunk Employee
Splunk Employee

Bear in mind that indexing performance is about 30% slower on a virtual machine. Search performance is about equivalent to physical hardware.

Highlighted

Re: Recommended Virtual Machine Sizes for Search Head and Indexer

SplunkTrust
SplunkTrust

Yeah, that looks better. I'm not 100% certain if 16/8 memory distribution is better than 12/12, but changing that is not going to have an enormous impact. More is always better of course, but you should be fine for a pedestrian 10GB/day...

View solution in original post

Highlighted

Re: Recommended Virtual Machine Sizes for Search Head and Indexer

Motivator

finally have the power to convert to answer 🙂 Thanks for your help martin.

0 Karma