Does the number of forwarders determine the number of indexers and search heads for our environment?

[josefa123]

I saw this table when I was researching the correct Hardware requirements for Splunk. I have a total users of 2 for now and the data that will be indexed would be somewhere 13gb-15gb per day estimated. In the table it is clear that I only need a combined instance, so the indexer and search head would be on the same machine. My uncertainties here is that we need to have 15000+ forwarders. Does this affect the number of indexers and search heads or not? Thanks

[martin_mueller]

Skipping to the next page in the Capacity Planning Manual at http://docs.splunk.com/Documentation/Splunk/latest/Capacity/Forwarder-to-indexerratios Splunk claims 2000-5000 forwarders per indexer, giving you three to eight indexers for 15000 forwarders.

The number of search heads is unaffected by the number of forwarders.

[martin_mueller]

That's from (an older version of) the Capacity Planning Manual: http://docs.splunk.com/Documentation/Splunk/6.3.2/Capacity/Summaryofperformancerecommendations

[Richfez]

Nice, could you please link where you found this table?

[esix_splunk]

How are you calculating your per day estimates if you are having 15000+ forwarders? What is your use case?

By numbers alone, at 15gb alone, you can get away with a single search heard / indexer.