Which is better: building a heavy forwarder in Azure or using the Azure Marketplace BYOL option?

[rbrisseyii]

If I need to build a heavy forwarder in Azure, is it better to do it from scratch or use the Azure Marketplace BYOL option?

[jconger · Accepted solution]

Splunk Enterprise on the Azure Marketplace is provisioned with several data disks meant for indexing activity. If you just want a heavy forwarder, it would be better to build the forwarder from scratch without the extra disks.

[sarnathkj]

What is the capacity/Azure SKU you would suggest for an environment that would be forwarding 10 TB of data per day? I see per Splunk Documentation, for large scale deployment, they recommend to use Standard_D15_v2 - 5 instances indexing 1 TB of data with search load from 8 concurrent users.

https://www.splunk.com/pdfs/technical-briefs/deploying-splunk-enterprise-on-microsoft-azure.pdf

https://docs.microsoft.com/en-us/azure/virtual-machines/dv2-dsv2-series-memory?toc=/azure/virtual-ma...