Installation

How do I scale my Splunk deployment to account for rising demand in indexing volume?

vanderaj2
Path Finder

Hi Splunkers,

My program is considering adding 600 more Linux UF endpoints to our current Splunk deployment (we have ~450 total UF endpoints now), and they're asking for a "wish list" of resources to support the additional volume.

I have a pretty good idea of my licensing needs, and I've been using the Splunk online sizing tool to figure out how much additional disk capacity we need (based on our retention policies).

Is there also a good sizing tool or document out there to help me figure out whether I need to increase RAM/CPU on my indexers, and possibly add another indexer? (and maybe add another deployment server)

Just FYI - I currently have a 2 indexer cluster. Each indexer has 16 cores, 31 GB RAM

Labels (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

somesoni2 has already linked to it but the Splunk Capacity Planning manual is what you want to refer to...

0 Karma

DalJeanis
Legend

Did you mean another search head? A second deployment server doesn't seem to make sense in context.

0 Karma

somesoni2
Revered Legend

He may be asking as number of clients are increasing too. @vanderaj2,, you can see great discussion in this post to understand the H/W requirement and suggested Deployment client load for Deployment servers here.

0 Karma

vanderaj2
Path Finder

Yep! that was exactly why I mentioned the deployment server. That discussion thread was very helpful -- thank you somesoni2!

0 Karma

somesoni2
Revered Legend
0 Karma

vanderaj2
Path Finder

Very helpful!! Thank you sir.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...