I saw this table when I was researching the correct Hardware requirements for Splunk. I have a total users of 2 for now and the data that will be indexed would be somewhere 13gb-15gb per day estimated. In the table it is clear that I only need a combined instance, so the indexer and search head would be on the same machine. My uncertainties here is that we need to have 15000+ forwarders. Does this affect the number of indexers and search heads or not? Thanks
Skipping to the next page in the Capacity Planning Manual at http://docs.splunk.com/Documentation/Splunk/latest/Capacity/Forwarder-to-indexerratios Splunk claims 2000-5000 forwarders per indexer, giving you three to eight indexers for 15000 forwarders.
The number of search heads is unaffected by the number of forwarders.
That's from (an older version of) the Capacity Planning Manual: http://docs.splunk.com/Documentation/Splunk/6.3.2/Capacity/Summaryofperformancerecommendations
Nice, could you please link where you found this table?
How are you calculating your per day estimates if you are having 15000+ forwarders? What is your use case?
By numbers alone, at 15gb alone, you can get away with a single search heard / indexer.