Deployment Architecture

Hardware Requirements for 30GB/Day

rami1918
Engager

Hi,

We are planning to move our Splunk environment to our Nutanix infrastructure. We expect our collected logs to be 20-30 GB/Day and Splunk is mainly used as a SIEM solutions where around 4 users are accessing concurrently

We had some internal discussions, and I wanted to understand if we can use less resources than the mentioned below to run Splunk+ES, and if any one is running a similar setup can share the used hardware specs

Search head 24vCPU, 32GB
ES search head 24vCPU, 32GB
Indexer 24vCPU, 32GB
License + Deployment 12vCPU, 16GB

Thanks

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rami1918,

the minimum requirent6es for Enterprise Security installation is:

Search head16 cores32GB
Indexer16 cores32GB

As you can see at https://docs.splunk.com/Documentation/ES/6.5.0/Install/DeploymentPlanning

But I hint to use more CPUs especially if you have to enable many scheduled searches, so I think that it's better to use the configuration you proposed.

Eventually you could reduce RAM for the Deployment Server to 12 GB and analyze the Apps to install in the other Search Head to understand if you can reduce something in that installation, but don't reduce ES Search Head and Indexer.

Maintaining the same use of CPUs probably (you can understand this only after the analysis I hinted) it's better to reduce the CPUs and RAM on the first Search Head and put those resources in the ES Search Head and Indexer.

Ciao.

Giuseppe

View solution in original post

rami1918
Engager

Thanks,

I wanted to clarify one more thing. Our vendor is providing us the CPU with 3.2 GHz, I have reviewed one document for Splunk stating that the requirements is 2 GHz. Will this reduce the amount of required cores?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rami1918,

No I don't think!

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rami1918,

the minimum requirent6es for Enterprise Security installation is:

Search head16 cores32GB
Indexer16 cores32GB

As you can see at https://docs.splunk.com/Documentation/ES/6.5.0/Install/DeploymentPlanning

But I hint to use more CPUs especially if you have to enable many scheduled searches, so I think that it's better to use the configuration you proposed.

Eventually you could reduce RAM for the Deployment Server to 12 GB and analyze the Apps to install in the other Search Head to understand if you can reduce something in that installation, but don't reduce ES Search Head and Indexer.

Maintaining the same use of CPUs probably (you can understand this only after the analysis I hinted) it's better to reduce the CPUs and RAM on the first Search Head and put those resources in the ES Search Head and Indexer.

Ciao.

Giuseppe

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!