Deployment Architecture

What are the minimum hardware requirements for dedicated hosts for specific roles?

Glasses2
Communicator

Hi 

I have been thru the docs but don't see any specific detail regarding system hardware needed for Specific Roles....

Let's say you have a 3 member SHC and a 10 member IDXC.

IF you were to put the deployer role on a separate box, what would you need at a minimum? (For instance > maybe 8 Cores, 12G Ram, 1OOG Disk)

And what would you need for the following roles if each and every one was on a dedicated VM?

License Manager

Monitoring Console

Index Cluster Master

Deployment Server

I find the documentation is more specific for SHs and Indexers, but per documentation >>> “For detailed sizing and resource allocation recommendations, contact your Splunk account team”.

I am up against a HW resource wall, and need to shuffle some things around.  So any advice or lessons learned on the "minimum hardware requirements topic" are greatly appreciated.  

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Glasses2,

you're right when you say thet there's a dedicated information for SHs and IDXs but not for the other roles.

In this case, if you speak with Splunk Support or PS, they hint the Stand-alone minimal configuration: 12 CPUs 12 GB RAM.

But for some roles I used a less configuration and I shared the same server for more roles.

In details:

Deployer: doesn,t need much CPUs and RAM, you can use 8 CPUs and 8 GBs RAM,but only for this role it's better to have at least 100 GB disk, because you could have disk space problem in big bundle replication.

License Manager: doesn't require a dedicated server, I usually  use Master Node.

Monitoring Console: doesn't require a dedicated server, I usually  use Deployer (better) or Master Node (if there aren't many IDXs).

Index Cluster Master: dedicated server, at least also License Master.

Deployment Server: dedicated server if it has to manage more than 50 clients.

All these Servers should have 12 CPUs and 12 GB RAM and 50 GB disk, but they can work also with 8 CPUs and 8 GB RAM.

Remember that if you have ES or ITSI or many users and scheduled searches, you need more resources on SHs and IDXs.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Glasses2,

you're right when you say thet there's a dedicated information for SHs and IDXs but not for the other roles.

In this case, if you speak with Splunk Support or PS, they hint the Stand-alone minimal configuration: 12 CPUs 12 GB RAM.

But for some roles I used a less configuration and I shared the same server for more roles.

In details:

Deployer: doesn,t need much CPUs and RAM, you can use 8 CPUs and 8 GBs RAM,but only for this role it's better to have at least 100 GB disk, because you could have disk space problem in big bundle replication.

License Manager: doesn't require a dedicated server, I usually  use Master Node.

Monitoring Console: doesn't require a dedicated server, I usually  use Deployer (better) or Master Node (if there aren't many IDXs).

Index Cluster Master: dedicated server, at least also License Master.

Deployment Server: dedicated server if it has to manage more than 50 clients.

All these Servers should have 12 CPUs and 12 GB RAM and 50 GB disk, but they can work also with 8 CPUs and 8 GB RAM.

Remember that if you have ES or ITSI or many users and scheduled searches, you need more resources on SHs and IDXs.

Ciao.

Giuseppe

Roy_9
Motivator

Hi @Glasses2 

I followed this manual when building my environment.

https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware

 

Hope this helps.

 

 

Thanks

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...