License suggestion



For a very large environment what would be the license requirement?
How many Search Heads, Indexers, Forwarders required and what are all the other components required?

Labels (3)
0 Karma


It is hard to determine what is the correct hardware specifications without know your use cases. As commented, the best thing to do is to contact the Splunk Sales Engineering to run an assessment in your environment to identify your needs and the amount of data for daily ingestion.
A lot of aspects have to be considered like:
- Virtual/Physical Hardware
- The amount of data to be indexed
- Which are the source types to be indexed(windows log, linux log, Network Devices, Security logs, Database connections, and others)
- Data Retention
- How many users to login/run adhoc/scheduled reports
- Splunk apps to be installed in your environment, also have a different impact on performance and disk storage as well.
- Is single/multi-site cluster required?
- Is Disaster recovery topology required?

Here are some documents where can assist you to have a reference for high volume of data processing:
- Hardware specification ->
- How search types affect Splunk Enterprise performance ->
- How Splunk Enterprise calculates disk storage ->
- Disk sizing ->
- How concurrent users and searches impact performance ->
- Expected performance and known limitations of real-time searches and reports ->

So for those reasons, I strongly recommend to involve Splunk Sales Engineering on this case in order to map your needs and also better estimate the license, hardware, apps and storage. I hope these documents can better assist you to understand how you can size your environment to have a good conversation with Splunk.

0 Karma

Revered Legend

Licenses specify how much external data you can index per day and not the size of the environment (though one of the factor for setting up larger environment is amount of index data indexed). So find out how much total data you will index per day (and may be add some buffer) and use that data to arrive at license requirement. See this link for more information on licensing:

Regarding all the components of your Splunk deployment and their sizing, read through Splunk documentation ( . There are various factors in planning the topology and sizing.

0 Karma


It depends on many factors. I do not work for Splunk but I'll suggest to discuss this with Splunk Sales and they will guide you.

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...