Deployment Architecture

Hardware Requirements for 30GB/Day

rami1918
Engager

Hi,

We are planning to move our Splunk environment to our Nutanix infrastructure. We expect our collected logs to be 20-30 GB/Day and Splunk is mainly used as a SIEM solutions where around 4 users are accessing concurrently

We had some internal discussions, and I wanted to understand if we can use less resources than the mentioned below to run Splunk+ES, and if any one is running a similar setup can share the used hardware specs

Search head 24vCPU, 32GB
ES search head 24vCPU, 32GB
Indexer 24vCPU, 32GB
License + Deployment 12vCPU, 16GB

Thanks

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rami1918,

the minimum requirent6es for Enterprise Security installation is:

Search head16 cores32GB
Indexer16 cores32GB

As you can see at https://docs.splunk.com/Documentation/ES/6.5.0/Install/DeploymentPlanning

But I hint to use more CPUs especially if you have to enable many scheduled searches, so I think that it's better to use the configuration you proposed.

Eventually you could reduce RAM for the Deployment Server to 12 GB and analyze the Apps to install in the other Search Head to understand if you can reduce something in that installation, but don't reduce ES Search Head and Indexer.

Maintaining the same use of CPUs probably (you can understand this only after the analysis I hinted) it's better to reduce the CPUs and RAM on the first Search Head and put those resources in the ES Search Head and Indexer.

Ciao.

Giuseppe

View solution in original post

rami1918
Engager

Thanks,

I wanted to clarify one more thing. Our vendor is providing us the CPU with 3.2 GHz, I have reviewed one document for Splunk stating that the requirements is 2 GHz. Will this reduce the amount of required cores?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rami1918,

No I don't think!

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rami1918,

the minimum requirent6es for Enterprise Security installation is:

Search head16 cores32GB
Indexer16 cores32GB

As you can see at https://docs.splunk.com/Documentation/ES/6.5.0/Install/DeploymentPlanning

But I hint to use more CPUs especially if you have to enable many scheduled searches, so I think that it's better to use the configuration you proposed.

Eventually you could reduce RAM for the Deployment Server to 12 GB and analyze the Apps to install in the other Search Head to understand if you can reduce something in that installation, but don't reduce ES Search Head and Indexer.

Maintaining the same use of CPUs probably (you can understand this only after the analysis I hinted) it's better to reduce the CPUs and RAM on the first Search Head and put those resources in the ES Search Head and Indexer.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...