The reference hardware for a Splunk Search Head (as of Feb 2016) recommends the following:
2 x 300GB, 10,000 RPM SAS hard disks, configured in RAID 1
Will this actually be sufficient for multiple TB/day of data when there are many accelerated searches and summaries? With Search Head clustering?
I'm thinking at least 3 Search Heads for around 3/TB of data/day, but the size of the disks recommended concern me.
I know it's a moving target with a lot of caveats, so how does one approach sizing Search Head disk utlization?
The amount of TB a day should not impact the search head - rather its the number of searches that will be run that will make a difference. How many users and searches will you have is a more important question unless ou're planning to do the indexing and searching on the same server, in which case - you're crazy 🙂
At that level of licensing your splunk sales rep should be very friendly indeed - give Splunk a call they should be able to give you some good suggestions that they then will be on the hook for !
Also if this is a fresh installation, look at search head clustrering from the start - you may want to think about a larger pool of less capable servers