In addition to the above instances, the virtual host should also be able to accommodate a separate distributed search environment consisting of:
1 search head (also acting as deployment server and license master)
2 forwarders installed on Linux images
So in all, a total of 20 virtual instances will be hosted. As this is a sandbox environment, the volume of data being forwarded/indexed will be minimal - definitely less than 10GB/day if that. We will be using VirtualBox for the images with CentOS 7 - minimal as the operating system on the images.
Given the above criteria, I need to procure the machine that will host all of these images. Specifically I need to know:
Number of CPUs/cores required
Number of hard drives required
Individual hard drive capacity
Individual hard drive specs
Hard drive RAID configuration
I would also need to know the specifications that the individual CentOS 7 virtual images (for the different types of instances) would require such as:
Allocated disk space
If I have missed any critical specification then please feel free to add/comment on that also.
What I suggest is jotting down the specs you'd like to have based on the recommendations in the documentation listed above for each VM. then with that, tally it all together (total virtual RAM => RAM, total disk, total vCPUs => CPUs) all then tallied to determine what size box(es) you would need to accommodate that type of workload. Not really a tool out there to do that, as architecting something like this is a bit of a skill, art and SWAG.
Avisram, the Tech Brief recommended above is definitely for a production environment. It is probably ideal to have a physical host with at least 20 cores and 256GB RAM for this environment. It's impossible to make a recommendation for storage based on the information provided. Would need to factor how long you plan to retain data in this environment, and work backwards from that (this site might help you: http://splunk-sizing.appspot.com/ ).
If you plan to do multiple physical hosts for this environment, you can probably do smaller core count boxes. If you are building this to perform well, I would need further information to size this.