What is the infrastructure recommendation based on daily volume?

[bayman]

What is the infrastructure recommendation for ~40-50GB/day with ~150 servers? Can VM be deployed vs Physical servers?

[adonio]

kindly read here:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Capacity/Referencehardware
there are other factors involved, such as are you going to use Deployment Server etc.
to your question, based on these metrices, you can use reference hardware from the manual linked above.
1 machine will be ok.
VM will be ok but you have to make sure the cores are dedicated.
this will sum up all the little caviaets and things to pay attention to.
https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf
good luck and happy splunking

[richgalloway]

This unofficial link may help. http://splunk-sizing.appspot.com

Yes, you can use VMs. See http://docs.splunk.com/Documentation/Splunk/6.6.0/Capacity/Referencehardware#Virtual_hardware

[rphillips_splk]

@bayman Splunk provides some guidance in the capacity planning manual which is a good starting point to help you understand the different dimensions you will need to consider when planning your deployment such as incoming data, search load, number of users, apps deployed on the SH. We do have customers using VMs however best practice recommendation is to use bare metal for Splunk indexer instances.

http://docs.splunk.com/Documentation/Splunk/6.6.0/Capacity/IntroductiontocapacityplanningforSplunkEn...