Deployment Architecture

Distributed search sizing

ontai
Explorer

I've looked through some of the documentation for separating search heads from indexers depending on the number of concurrent searches and users. I'm wondering what a rough idea of the architecture and hardware requirements would look like to support:

10-20 GB per day
20 concurrent users
10 concurrent saved searches

Thanks.

Craig

Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee

Given your user and scheduler concurrency, you would probably be best off implementing an indexer and a search head. Although you can easily index 80-100 GB/day on a single commodity server, having 20 concurrent users and 10+ concurrent scheduled searches on the same machine wouldn't allow for the best user experience or much room for growth.

0 Karma

Takajian
Builder

I agree your suggestion. This is appropriate sizing with considering to future plan. My answer was rough idea.

0 Karma

Takajian
Builder

I do not think you do not need dedicated search head when you index data less than 100GB per day on one box server. You can also refer to following site. Hope this help.

http://docs.splunk.com/Documentation/Splunk/latest/installation/capacityplanningforalargersplunkdepl...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...