I am into advanced dashboard currently. In my recent interview I have been asked about the architecture including the Cpu,memory and IPs for 2 TErabyte of data for splunk.How should I answer that?

[abhi04]

I am into advanced dashboard currently. In my recent interview I have been asked about the architecture including the Cpu,memory and IPs for 2 TErabyte of data for splunk.How should I answer that?

[tiagofbmm]

Well the 2TB of data itself is not a main concern here.

You should have asked about daily ingestion rate and what kind of data sources that intend to ingest. With that in mind, Splunk recommends one Indexer per 250Gb of data ingested daily. That indexer would need minimum 12GB Ram, 800 IOPS and 1 x 12 Cores at 2+GHz per core

About OS, a Windows or Linux 64 bits.

To get the most IOPS, choose drives with high rotational speeds and low average latency and seek times.

For Search Heads, Splunk recommends 4x4Cores at 2GHz (10-12 concurrent jobs), 16GB RAM. Notice also that the sizing depends mainly on the Number of searches, users, summarization/acceleration jobs, real time searches, etx

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that