What are the minimum hardware requirements for dedicated hosts for specific roles?

[Glasses2]

Hi 

I have been thru the docs but don't see any specific detail regarding system hardware needed for Specific Roles....

Let's say you have a 3 member SHC and a 10 member IDXC.

IF you were to put the deployer role on a separate box, what would you need at a minimum? (For instance > maybe 8 Cores, 12G Ram, 1OOG Disk)

And what would you need for the following roles if each and every one was on a dedicated VM?

License Manager

Monitoring Console

Index Cluster Master

Deployment Server

I find the documentation is more specific for SHs and Indexers, but per documentation >>> “For detailed sizing and resource allocation recommendations, contact your Splunk account team”.

I am up against a HW resource wall, and need to shuffle some things around.  So any advice or lessons learned on the "minimum hardware requirements topic" are greatly appreciated.  

[gcusello · Accepted solution]

Hi @Glasses2,

you're right when you say thet there's a dedicated information for SHs and IDXs but not for the other roles.

In this case, if you speak with Splunk Support or PS, they hint the Stand-alone minimal configuration: 12 CPUs 12 GB RAM.

But for some roles I used a less configuration and I shared the same server for more roles.

In details:

Deployer: doesn,t need much CPUs and RAM, you can use 8 CPUs and 8 GBs RAM,but only for this role it's better to have at least 100 GB disk, because you could have disk space problem in big bundle replication.

License Manager: doesn't require a dedicated server, I usually  use Master Node.

Monitoring Console: doesn't require a dedicated server, I usually  use Deployer (better) or Master Node (if there aren't many IDXs).

Index Cluster Master: dedicated server, at least also License Master.

Deployment Server: dedicated server if it has to manage more than 50 clients.

All these Servers should have 12 CPUs and 12 GB RAM and 50 GB disk, but they can work also with 8 CPUs and 8 GB RAM.

Remember that if you have ES or ITSI or many users and scheduled searches, you need more resources on SHs and IDXs.

Ciao.

Giuseppe

[Roy_9]

Hi @Glasses2 

I followed this manual when building my environment.

https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware

Hope this helps.

Thanks