Hardware Requirements for 30GB/Day

[rami1918]

Hi,

We are planning to move our Splunk environment to our Nutanix infrastructure. We expect our collected logs to be 20-30 GB/Day and Splunk is mainly used as a SIEM solutions where around 4 users are accessing concurrently

We had some internal discussions, and I wanted to understand if we can use less resources than the mentioned below to run Splunk+ES, and if any one is running a similar setup can share the used hardware specs

Search head 24vCPU, 32GB
ES search head 24vCPU, 32GB
Indexer 24vCPU, 32GB
License + Deployment 12vCPU, 16GB

Thanks

[rami1918]

Thanks,

I wanted to clarify one more thing. Our vendor is providing us the CPU with 3.2 GHz, I have reviewed one document for Splunk stating that the requirements is 2 GHz. Will this reduce the amount of required cores?

[gcusello]

Hi @rami1918,

No I don't think!

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @rami1918,

the minimum requirent6es for Enterprise Security installation is:

Search head	16 cores	32GB
Indexer	16 cores	32GB

As you can see at https://docs.splunk.com/Documentation/ES/6.5.0/Install/DeploymentPlanning

But I hint to use more CPUs especially if you have to enable many scheduled searches, so I think that it's better to use the configuration you proposed.

Eventually you could reduce RAM for the Deployment Server to 12 GB and analyze the Apps to install in the other Search Head to understand if you can reduce something in that installation, but don't reduce ES Search Head and Indexer.

Maintaining the same use of CPUs probably (you can understand this only after the analysis I hinted) it's better to reduce the CPUs and RAM on the first Search Head and put those resources in the ES Search Head and Indexer.

Ciao.

Giuseppe