Hi @VijaySrrie,
an installation for 2TB of logs isn't an immediate architecture, and it isn't a good idea to design it in this way.
I hint to engage a Splunk Professional Service or at least a Splunk Architect to design it.
Anyway, the number of Indexers depends on many factors:
- Have you a cluster?
- how many copies of the data you want to maintain?
- have you Enterprise Security or ITSI?
Anyway, if you haven't ES or ITSI, you should use around 10 Indexers.
You could take some idea viewing the Validated Splunk Architecture (https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf).
the hardware reference depends on the number of users and scheduled searches (https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware).
At the same time, you should also design the number of Search Heads and the other components of the Splunk architecture.
For all these reasons, I hint to engage an Architect!
Ciao.
Giuseppe
