Distributed search sizing

[ontai]

I've looked through some of the documentation for separating search heads from indexers depending on the number of concurrent searches and users. I'm wondering what a rough idea of the architecture and hardware requirements would look like to support:

10-20 GB per day
20 concurrent users
10 concurrent saved searches

Thanks.

Craig

[araitz]

Given your user and scheduler concurrency, you would probably be best off implementing an indexer and a search head. Although you can easily index 80-100 GB/day on a single commodity server, having 20 concurrent users and 10+ concurrent scheduled searches on the same machine wouldn't allow for the best user experience or much room for growth.

[Takajian]

I agree your suggestion. This is appropriate sizing with considering to future plan. My answer was rough idea.

[Takajian]

I do not think you do not need dedicated search head when you index data less than 100GB per day on one box server. You can also refer to following site. Hope this help.

http://docs.splunk.com/Documentation/Splunk/latest/installation/capacityplanningforalargersplunkdepl...