Splunk Sizing

[sidtalup27]

Hello,

We are sizing a Splunk solution for internal usage. Referring to the documentation, it is said that Mid size Indexer will require 48vCPU and 64Gb RAM. However, I wanted to understand how much EPS will this kind of indexer handle.

Please advise

[isoutamo]

That size node should work well for most cases. As @johnhuang said, in pure splunk indexing it should manage 300Gb/d. Then if you have e.g. ES or ITSI then it’s different story.

EPS is dependent of your event size, complexity and what your want to do with them. We should separate EPS for ingestion and search time as those are totally different cases.  Also you should ensure that your storage has at least 800+ (preferred 1200+) IOPS to move data in and out enough quickly. There are couple of tools like Bonnie or fio which you could use to check that.

t. Ismo

[johnhuang]

Here's the sizing recommendation from Splunk: Capacity Planning Manual - Summary of performance recommendations. Your hardware spec should comfortably handle 300GB/day.