Setting up Splunk from the scratch

[VijaySrrie]

Hi,

 implementing Splunk for the very first time in a new project

Need to do set up Splunk from the scratch


Multi site clustered env
2 TB License

How to calculate the number of Indexers and Search heads?
Please let me know the end to end steps to take care of

[gcusello]

Hi @VijaySrrie,

an installation for 2TB of logs isn't an immediate architecture, and it isn't a good idea to design it in this way.

I hint to engage a Splunk Professional Service or at least a Splunk Architect to design it.

Anyway, the number of Indexers depends on many factors:

• Have you a cluster?
• how many copies of the data you want to maintain?
• have you Enterprise Security or ITSI?

Anyway, if you haven't ES or ITSI, you should use around 10 Indexers.

You could take some idea viewing the Validated Splunk Architecture (https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf).

the hardware reference depends on the number of users and scheduled searches (https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware).

At the same time, you should also design the number of Search Heads and the other components of the Splunk architecture.

For all these reasons, I hint to engage an Architect!

Ciao.

Giuseppe