How do you find the maximum of volume data that is coming into Splunk?

[mojgh94]

Hi there,

I read the document of Splunk and it said about 3TB/day, but I want to send data ( about 500 TB/day) into Splunk Enterprise.

How many indexers and search heads do I need to install?

How do I configure Splunk for giving this data?

How many resources do I need?

Thanks.

[inventsekar · Accepted solution]

3 Search Heads, 21 Indexers, Total Users: up to 48
2 to 3TB/day
https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Summaryofperformancerecommendations

Lets assume, 20 indexers can index 3 TB (approx 500/3=165.. 165*20=3300 )
3300 indexers required to index 500TB data per day.

for 500TB per day requirement, you can contact Splunk Sales, they would help you in designing and deployment of this requirement.

As you are a new user to Splunk Answers, you can upvote the answers/comments,
if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!