Deployment Architecture

No of search head required.

New Member

I am sizing for various ingestion volumes of 1 TB,5 TB,10 TB and 20 TB ,considering 300 GB per indexer and upto 24 users.

As per splunk Documentation search heads are based on no of user but is there anyway where i can find the find the ratio of indexers to search head.

I am able to get number of indexers based on sizing app ,but unable to decide on search heads.

for eg: 5 TB , i require 17 indexers but how many search heads?

Can somebody please highlight the general rule to decide on search head depending upon the no of indexers or provide a similar app to calculate no of search head.

Tags (1)
0 Karma


Hi Swathi,

The following documentation might give you the idea for your Search Head requirement.

Just a suggestion - From existing environment, keep one search head for scheduled jobs or alerts or add extra search head.
It will provide good user experience as all scheduled jobs processing will be handled by non user facing search head.

Accept and upvote the answer if it helps.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...