Deployment Architecture

What disk space is actually needed for indexes on a search head?

mfrost8
Builder

I'm trying to build some new search heads and I'm looking at how much disk space I should really need for indexes ($SPLUNK_DB) on a search head, particularly if I'm configuring that search head to forward any events its told to index to the indexers as is the recommended best practice.

I see that there is some space used on my current indexers and that a certain minimum amount is probably necessary. Could I potentially scale back indexes that exist on the search heads for one reason or another (sos, os) so that they're very small since any events that are supposed to go there will be forwarded to indexers anyway where they'll be more space allocated?

I was thinking about 10GB of local space for indexes on the search heads, but if I don't even have to use that much, I'd rather not, especially when I can use it for dispatch.

Thanks

0 Karma
1 Solution

jensonthottian
Contributor

The defauk indexes in your indexer are summary, main, history, _thefishbucket, _introspection, _internal, _blocksignature, _audit.

Generally _audit is the one which will consume the most diskspace which too will be way less. I think 10 GB should be good enough for diskspace for all indexes in search head. Default max is set for each of these indexes as 500 GB.

View solution in original post

jensonthottian
Contributor

The defauk indexes in your indexer are summary, main, history, _thefishbucket, _introspection, _internal, _blocksignature, _audit.

Generally _audit is the one which will consume the most diskspace which too will be way less. I think 10 GB should be good enough for diskspace for all indexes in search head. Default max is set for each of these indexes as 500 GB.

mfrost8
Builder

Hmm. I was hoping it could be way less. OK, 10 GB it is. Th anks.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...