License Server minimum

[kirk_in_porto]

Splunk docs show all deployment components needing a minimum of x64, 12 cores, 12GB, 2GHZ

My question is for a dedicated license server for a VERY small distributed system for training and development.

I want a search head, and indexer and then separate LM, and DS.  The data volume is small, less than 2GB/day.

Do I really need the full blown minimums for an LM that will have a single Dev License?  I wanted to put this onto an RPi, but ...... yeh ..... doesn't look like an option.

I have a couple of low end NUC's that will be x64, but won't meet the minimums for cores or RAM.

Would welcome any assistance or even mentoring on this project.

[PickleRick]

License server is I think the least stressed component of the Splunk architecture (maybe along with a SHC deployer) so it usually can be scaled down and/or deployed as a joint role with something else (for example a SHC deployer doubling down as license server). That's from a strictly "technical" point of view. If that's a small scale lab, you can probably get away with something much much smaller for a LM. But of course if it was a prod environment the usual answer from support for any issues would probably be "your servers are below specs".

[tej57]

Hey @kirk_in_porto ,

These are the minimum required hardware specifications. It is not that Splunk won't work with less number of cores or RAM, but it'll affect the performance. You might not get efficient output from less cores if you intend to run more number of searches or processes through the license manager instance. It'll still try to function as much as it can. However, just for training purpose, it is okay to have less number of cores/RAM associated to an instance.

Thanks,
Tejas.

[gcusello]

Hi @kirk_in_porto ,

are you speaking of a lab or a production environment?

if it's for a production environment, don't use less than the required resources, and if you can give more of them!

Eventually, you can have less resources for the management servers, but not for SHs and IDXs.

If instead you're speaking of a lab, you can use all the resources you have and it runs.

I created a lab on my workstation (i7 with 16 vcpu and 32 GB of RAM) with six Splunk servers: 2 IDXs, 3 SHs, 1 management server (CM, SHC-D and DS), each one with one vcpu and 4 GB RAM.

Obviously I have few data and I have very slow results, but it runs.

Ciao.

Giuseppe