Getting Data In

Does the number of forwarders determine the number of indexers and search heads for our environment?

Explorer

alt text

I saw this table when I was researching the correct Hardware requirements for Splunk. I have a total users of 2 for now and the data that will be indexed would be somewhere 13gb-15gb per day estimated. In the table it is clear that I only need a combined instance, so the indexer and search head would be on the same machine. My uncertainties here is that we need to have 15000+ forwarders. Does this affect the number of indexers and search heads or not? Thanks

0 Karma

SplunkTrust
SplunkTrust

Skipping to the next page in the Capacity Planning Manual at http://docs.splunk.com/Documentation/Splunk/latest/Capacity/Forwarder-to-indexerratios Splunk claims 2000-5000 forwarders per indexer, giving you three to eight indexers for 15000 forwarders.

The number of search heads is unaffected by the number of forwarders.

SplunkTrust
SplunkTrust

That's from (an older version of) the Capacity Planning Manual: http://docs.splunk.com/Documentation/Splunk/6.3.2/Capacity/Summaryofperformancerecommendations

0 Karma

SplunkTrust
SplunkTrust

Nice, could you please link where you found this table?

0 Karma

Splunk Employee
Splunk Employee

How are you calculating your per day estimates if you are having 15000+ forwarders? What is your use case?

By numbers alone, at 15gb alone, you can get away with a single search heard / indexer.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!