Splunk want to ensure that your hardware is "enough powerful" to do the base processing and for that reason they have defined some example configurations which fulfil that requirement. In real life especially in small environments (both single node and distributed) you could start with smaller if needed. The most important thing is enough IOPS from disks.
You should just estimate your real needs and then create needed virtual or physical hardware for that. When you are using virtual you could easily start with smaller instance(s) and add capacity and instances as needed, but remember the IOPS needs!