It is hard to determine what is the correct hardware specifications without know your use cases. As commented, the best thing to do is to contact the Splunk Sales Engineering to run an assessment in your environment to identify your needs and the amount of data for daily ingestion.
A lot of aspects have to be considered like:
- Virtual/Physical Hardware
- The amount of data to be indexed
- Which are the source types to be indexed(windows log, linux log, Network Devices, Security logs, Database connections, and others)
- Data Retention
- How many users to login/run adhoc/scheduled reports
- Splunk apps to be installed in your environment, also have a different impact on performance and disk storage as well.
- Is single/multi-site cluster required?
- Is Disaster recovery topology required?
So for those reasons, I strongly recommend to involve Splunk Sales Engineering on this case in order to map your needs and also better estimate the license, hardware, apps and storage. I hope these documents can better assist you to understand how you can size your environment to have a good conversation with Splunk.
Licenses specify how much external data you can index per day and not the size of the environment (though one of the factor for setting up larger environment is amount of index data indexed). So find out how much total data you will index per day (and may be add some buffer) and use that data to arrive at license requirement. See this link for more information on licensing: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/HowSplunklicensingworks