Getting Data In

How do you find the maximum of volume data that is coming into Splunk?

mojgh94
New Member

Hi there,

I read the document of Splunk and it said about 3TB/day, but I want to send data ( about 500 TB/day) into Splunk Enterprise.

How many indexers and search heads do I need to install?

How do I configure Splunk for giving this data?

How many resources do I need?

Thanks.

0 Karma
1 Solution

inventsekar
Super Champion

3 Search Heads, 21 Indexers, Total Users: up to 48
2 to 3TB/day
https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Summaryofperformancerecommendations

Lets assume, 20 indexers can index 3 TB (approx 500/3=165.. 165*20=3300 )
3300 indexers required to index 500TB data per day.

for 500TB per day requirement, you can contact Splunk Sales, they would help you in designing and deployment of this requirement.

As you are a new user to Splunk Answers, you can upvote the answers/comments,
if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!

View solution in original post

0 Karma

inventsekar
Super Champion

3 Search Heads, 21 Indexers, Total Users: up to 48
2 to 3TB/day
https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Summaryofperformancerecommendations

Lets assume, 20 indexers can index 3 TB (approx 500/3=165.. 165*20=3300 )
3300 indexers required to index 500TB data per day.

for 500TB per day requirement, you can contact Splunk Sales, they would help you in designing and deployment of this requirement.

As you are a new user to Splunk Answers, you can upvote the answers/comments,
if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!