Dashboards & Visualizations

I am into advanced dashboard currently. In my recent interview I have been asked about the architecture including the Cpu,memory and IPs for 2 TErabyte of data for splunk.How should I answer that?

abhi04
Path Finder

I am into advanced dashboard currently. In my recent interview I have been asked about the architecture including the Cpu,memory and IPs for 2 TErabyte of data for splunk.How should I answer that?

Tags (1)
0 Karma

tiagofbmm
Influencer

Well the 2TB of data itself is not a main concern here.

You should have asked about daily ingestion rate and what kind of data sources that intend to ingest. With that in mind, Splunk recommends one Indexer per 250Gb of data ingested daily. That indexer would need minimum 12GB Ram, 800 IOPS and 1 x 12 Cores at 2+GHz per core

About OS, a Windows or Linux 64 bits.

To get the most IOPS, choose drives with high rotational speeds and low average latency and seek times.

For Search Heads, Splunk recommends 4x4Cores at 2GHz (10-12 concurrent jobs), 16GB RAM. Notice also that the sizing depends mainly on the Number of searches, users, summarization/acceleration jobs, real time searches, etx

0 Karma

tiagofbmm
Influencer

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...