Installation

Setting up Splunk from the scratch

VijaySrrie
Builder

Hi,

 implementing Splunk for the very first time in a new project

Need to do set up Splunk from the scratch


Multi site clustered env
2 TB License

How to calculate the number of Indexers and Search heads?
Please let me know the end to end steps to take care of

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @VijaySrrie,

an installation for 2TB of logs isn't an immediate architecture, and it isn't a good idea to design it in this way.

I hint to engage a Splunk Professional Service or at least a Splunk Architect to design it.

Anyway, the number of Indexers depends on many factors:

  • Have you a cluster?
  • how many copies of the data you want to maintain?
  • have you Enterprise Security or ITSI?

Anyway, if you haven't ES or ITSI, you should use around 10 Indexers.

You could take some idea viewing the Validated Splunk Architecture (https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf).

the hardware reference depends on the number of users and scheduled searches (https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware).

At the same time, you should also design the number of Search Heads and the other components of the Splunk architecture.

For all these reasons, I hint to engage an Architect!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...