Knowledge Management

Recommended Virtual Machine Sizes for Search Head and Indexer

aelliott
Motivator

Does this seem like a good setup for a dedicated Search head, indexer for a virtualized Splunk?

Search Head
- 8 core 16 GB Ram

Indexer
- 8 core 8 GB Ram 1 TB Hard Drive

We will have approximately 3 concurrent users at a given time, and a throughput of 10 GB/day

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Yeah, that looks better. I'm not 100% certain if 16/8 memory distribution is better than 12/12, but changing that is not going to have an enormous impact. More is always better of course, but you should be fine for a pedestrian 10GB/day...

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Yeah, that looks better. I'm not 100% certain if 16/8 memory distribution is better than 12/12, but changing that is not going to have an enormous impact. More is always better of course, but you should be fine for a pedestrian 10GB/day...

aelliott
Motivator

finally have the power to convert to answer 🙂 Thanks for your help martin.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Bear in mind that indexing performance is about 30% slower on a virtual machine. Search performance is about equivalent to physical hardware.

aelliott
Motivator

I have modified my post, does that look much better?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'd swap the cores around, giving the search head more oomph.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...