Hi
We are looking into getting some more experience with Splunk Enterprise.
We therefore wanted to create a small distributed deployment.
We are only going to index about 5 gb per day.
The documentation distributed minimum requirements is for 300GB a per day.
So what is the minimum requirements for the search head and indexer for such a small distributed deployment?
Thank you for any help
You can make them as small as you like, just be aware that Splunk probably won't support anything under the minima. I'd go with 4 or more CPUs.
You can make them as small as you like, just be aware that Splunk probably won't support anything under the minima. I'd go with 4 or more CPUs.