Getting Data In

How do you find the maximum of volume data that is coming into Splunk?

New Member

Hi there,

I read the document of Splunk and it said about 3TB/day, but I want to send data ( about 500 TB/day) into Splunk Enterprise.

How many indexers and search heads do I need to install?

How do I configure Splunk for giving this data?

How many resources do I need?

Thanks.

0 Karma
1 Solution

Super Champion

3 Search Heads, 21 Indexers, Total Users: up to 48
2 to 3TB/day
https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Summaryofperformancerecommendations

Lets assume, 20 indexers can index 3 TB (approx 500/3=165.. 165*20=3300 )
3300 indexers required to index 500TB data per day.

for 500TB per day requirement, you can contact Splunk Sales, they would help you in designing and deployment of this requirement.

As you are a new user to Splunk Answers, you can upvote the answers/comments,
if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!

View solution in original post

0 Karma

Super Champion

3 Search Heads, 21 Indexers, Total Users: up to 48
2 to 3TB/day
https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Summaryofperformancerecommendations

Lets assume, 20 indexers can index 3 TB (approx 500/3=165.. 165*20=3300 )
3300 indexers required to index 500TB data per day.

for 500TB per day requirement, you can contact Splunk Sales, they would help you in designing and deployment of this requirement.

As you are a new user to Splunk Answers, you can upvote the answers/comments,
if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!

View solution in original post

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!