Aggregating WinEventLogs from 2,000 XP machines, total daily volume 20GB

[garfieldconnoll]

Hi,

So we've 2,000 XP machines generating c.20GB of WinEventLogs. For compliance reasons, we want to log it centrally.

We're considering using universal forwarders on each machine and then using 2- 4 intermediate forwarders to aggregate onto a single indexer.

I've read else where about suggested max ratio of 1000: 1 forwarders to indexer and even of an example of 6000:1 in a similar use case.

If we do use intermediate forwards, what sort of spec should we look at?

Thanks,

G.

[gkanapathy · Accepted solution]

You don't need intermediate forwarders. Go directly to the indexers. I don't know where you're reading about this, but there is no Splunk limit anywhere near as low as 1000 or even 6000 forwarders to an indexer. (The server OS or network settings, however, may have limits configured in that may have to be found and lifted.)

[garfieldconnoll]

Thanks for the prompt response. Not sure where I found the 1000 reference, but the 6000 example came from here on Answers.
Would a single deployment server be sufficient (if we set the phone home function to 600- 1200 seconds)?

Regards,

G.