Installation

Setting up Splunk from the scratch

VijaySrrie
Builder

Hi,

 implementing Splunk for the very first time in a new project

Need to do set up Splunk from the scratch


Multi site clustered env
2 TB License

How to calculate the number of Indexers and Search heads?
Please let me know the end to end steps to take care of

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @VijaySrrie,

an installation for 2TB of logs isn't an immediate architecture, and it isn't a good idea to design it in this way.

I hint to engage a Splunk Professional Service or at least a Splunk Architect to design it.

Anyway, the number of Indexers depends on many factors:

  • Have you a cluster?
  • how many copies of the data you want to maintain?
  • have you Enterprise Security or ITSI?

Anyway, if you haven't ES or ITSI, you should use around 10 Indexers.

You could take some idea viewing the Validated Splunk Architecture (https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf).

the hardware reference depends on the number of users and scheduled searches (https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware).

At the same time, you should also design the number of Search Heads and the other components of the Splunk architecture.

For all these reasons, I hint to engage an Architect!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...