- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![slebbie_splunk slebbie_splunk](https://community.splunk.com/legacyfs/online/avatars/443257.jpg)
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
What is the recommended hardware spec for a HF that is now indexing locally. Essentially, I know it's an Indexer that is just forwarding, so do we treat it as such in terms of hardware requirements?
12CPU? 12GB?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![esix_splunk esix_splunk](https://community.splunk.com/legacyfs/online/avatars/197958.jpg)
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
You can follow the reference architecture listed in docs. But what kind indexing volume is this box doing per day?
Without search load, 12gb + 12cores, and 900iops, should be able to deliver 200gb+ a day.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![esix_splunk esix_splunk](https://community.splunk.com/legacyfs/online/avatars/197958.jpg)
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
You can follow the reference architecture listed in docs. But what kind indexing volume is this box doing per day?
Without search load, 12gb + 12cores, and 900iops, should be able to deliver 200gb+ a day.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Do you mean the 200GB/day is for an 12vCPU/12GB RAM/900 IOPS Heavy Forwarder that is indexing locally and also forwarding to Indexers but not performing local searches?
In this 200GB/day are you also including logs from internal indexes ( index=_* ) ?
If so, what about an Heavy Forwarder with same specs that is not locally indexing? How many GB/day can process (internal and non internal logs)?
Thanks a lot,
Edoardo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![slebbie_splunk slebbie_splunk](https://community.splunk.com/legacyfs/online/avatars/443257.jpg)
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
To be honest, not much. 1.5gb. But there are massive blocked queues. Currently it's a 4 core box, more than likely a VM.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![jet1276 jet1276](https://community.splunk.com/legacyfs/online/avatars/436230.jpg)
I have seen Heavy Forwarder with 12 Core CPU and 12 GB RAM handling 500 GB/day logs.
But everything depends on how you configure the Splunk Deployment and Server configurations.
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)