Please suggest the best practise for splunk deployment
Index data of size 2GB daily
Data comes from 20 different hosts
Report generation on data
Search Factor=2, Replication Factor=2
20 forwarders to pull data from hosts
One master node, Two Peer Nodes(for Indexing) , One Search head
Data on each node would be 1GB (considering RF and SF)
My question is does this set up looks good or can i avoid search head as there are only two indexers, please suggest some best practices . Do i really need to go for cluster set up if not what can be done ?????
No, you don't need to have a cluster. It's a design decision which will give you added fault tolerance. Given the rather small amount of data you're indexing, a single server will most likely satisfy your capacity needs (depending on the amount of searches you will actually be making - scheduled or manual).
NB: with a cluster like you specified, the storage on each node will be 2GB daily, not 1GB, since you duplicate all your data (SF=2, RF=2). Thus it's 4GB spread over 2 indexers.