What disk space is actually needed for indexes on a search head?

[mfrost8]

I'm trying to build some new search heads and I'm looking at how much disk space I should really need for indexes ($SPLUNK_DB) on a search head, particularly if I'm configuring that search head to forward any events its told to index to the indexers as is the recommended best practice.

I see that there is some space used on my current indexers and that a certain minimum amount is probably necessary. Could I potentially scale back indexes that exist on the search heads for one reason or another (sos, os) so that they're very small since any events that are supposed to go there will be forwarded to indexers anyway where they'll be more space allocated?

I was thinking about 10GB of local space for indexes on the search heads, but if I don't even have to use that much, I'd rather not, especially when I can use it for dispatch.

Thanks

[jensonthottian · Accepted solution]

The defauk indexes in your indexer are summary, main, history, _thefishbucket, _introspection, _internal, _blocksignature, _audit.

Generally _audit is the one which will consume the most diskspace which too will be way less. I think 10 GB should be good enough for diskspace for all indexes in search head. Default max is set for each of these indexes as 500 GB.

[mfrost8]

Hmm. I was hoping it could be way less. OK, 10 GB it is. Th anks.