Deployment Architecture

Are these search head hardware specs sufficient for disk usage with search acceleration, summaries, and search head clustering?

New Member

The reference hardware for a Splunk Search Head (as of Feb 2016) recommends the following:

2 x 300GB, 10,000 RPM SAS hard disks, configured in RAID 1

Will this actually be sufficient for multiple TB/day of data when there are many accelerated searches and summaries? With Search Head clustering?

I'm thinking at least 3 Search Heads for around 3/TB of data/day, but the size of the disks recommended concern me.

I know it's a moving target with a lot of caveats, so how does one approach sizing Search Head disk utlization?

0 Karma


The amount of TB a day should not impact the search head - rather its the number of searches that will be run that will make a difference. How many users and searches will you have is a more important question unless ou're planning to do the indexing and searching on the same server, in which case - you're crazy 🙂

At that level of licensing your splunk sales rep should be very friendly indeed - give Splunk a call they should be able to give you some good suggestions that they then will be on the hook for !

Also if this is a fresh installation, look at search head clustrering from the start - you may want to think about a larger pool of less capable servers

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...