Getting Data In

What is the infrastructure recommendation based on daily volume?

Path Finder

What is the infrastructure recommendation for ~40-50GB/day with ~150 servers? Can VM be deployed vs Physical servers?

0 Karma

SplunkTrust
SplunkTrust

kindly read here:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Capacity/Referencehardware
there are other factors involved, such as are you going to use Deployment Server etc.
to your question, based on these metrices, you can use reference hardware from the manual linked above.
1 machine will be ok.
VM will be ok but you have to make sure the cores are dedicated.
this will sum up all the little caviaets and things to pay attention to.
https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf
good luck and happy splunking

0 Karma

SplunkTrust
SplunkTrust

This unofficial link may help. http://splunk-sizing.appspot.com

Yes, you can use VMs. See http://docs.splunk.com/Documentation/Splunk/6.6.0/Capacity/Referencehardware#Virtual_hardware

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Splunk Employee
Splunk Employee

@bayman Splunk provides some guidance in the capacity planning manual which is a good starting point to help you understand the different dimensions you will need to consider when planning your deployment such as incoming data, search load, number of users, apps deployed on the SH. We do have customers using VMs however best practice recommendation is to use bare metal for Splunk indexer instances.

http://docs.splunk.com/Documentation/Splunk/6.6.0/Capacity/IntroductiontocapacityplanningforSplunkEn...

0 Karma