Does anyone have personal experience-based hardware recommendations for these requirements?

[noybin]

Hello,

I need hardware recommendations for the following scenario:

1 Search Head
Indexer Cluster (search factor 2) (2 members)
1 Master Node
1 Heavy Forwarder (or cluster if possible)

7GB of events per day
50 alarms (no real time)
100 data sources

Also I would like to know if it is possible to have high availability on the heavy forwarders and how can it be achieved.

Thank you very much.

[richgalloway]

See the Splunk reference hardware specification at http://docs.splunk.com/Documentation/Splunk/6.6.3/Capacity/Referencehardware.

[noybin]

Thank's for your answer.

I've already read that document and it specifies different possible alternatives.

I was wondering if someone who has experience with a similar enviroment that mine, can recommend me based on the experience.

Thank's again

[richgalloway]

You should be fine going with the lowest specs in the "Reference host specification for distributed deployments" section. Treat your Master Node and Heavy Forwarder as search heads.

[noybin]

Thank you very much