Building for the Splunk Platform

Need a suggestion for implementing multi -site search factor ?

New Member

Hi All, Could any one guide us on the below requirement, as we need to finalize the infra setup for splunk.

Currently we have t*wo site located in two places with 3 nodes on each site*, so before going for the implementation we had question from Infra (storage team) for storage sizing. As it is multi site clustering could you please let us know what type of search factor and replication factor value should be suggested, so that based on that we can recommend the storage size to the infra team.

As per splunk document by default the site search factor is 2 and replication factor is 3, in the sense there were be two copies in one site and one copy at another site. In this case what will be storage sizing of each index node at each site.

Currently we have 60 GB of data being injected in index.

Tags (1)
0 Karma


You might want to play around with the sizing tool at
This is not published by Splunk, but it will give you an estimate.
The replication factor and search factor should be chosen based on the business case: how much risk can the business take vs. how much money can be spent on disk? The more copies, the less risk but larger storage costs. The Splunk defaults are a good starting point.

Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...