We have planne to install 2 indexers in cluster + 1 VM for search HEAD and 1 VM as master node.
We will start with 50GB/day of indexes data.
We would like to know if someone know the indexer limitation (how many log/by day) on this kind of hardware :
8 core at 2,40Ghz
4 x 8GO RAM
DD Local : 300GB + storage NAS > 1200 IOPS
Thanks by advance.
You probably want to review this: http://docs.splunk.com/Documentation/Splunk/5.0.2/Installation/Systemrequirements#Recommended_hardwa...
Based on those specs, you should be ok on the indexers. Just make sure your VMs have enough CPU and RAM to run searches.
Thanks for your answer, but in fact, I would like to know, based on the indexer hardware, the limitation (how many logs is it possible to manage with this hardware) ?
This is a pure capacity planning constraint for a futur usage.
You will then probably also want to review this: http://docs.splunk.com/Documentation/Splunk/5.0.2/Installation/CapacityplanningforalargerSplunkdeplo.... As long as your VMs can support searching (8 cores and 8 GB RAM), your current configuration should support 50GB/day indexing. The "How many logs" question is answered by "how much" you are indexing. As many logs as it takes to hit 50GB/day.