Knowledge Management

Recommended Virtual Machine Sizes for Search Head and Indexer

aelliott
Motivator

Does this seem like a good setup for a dedicated Search head, indexer for a virtualized Splunk?

Search Head
- 8 core 16 GB Ram

Indexer
- 8 core 8 GB Ram 1 TB Hard Drive

We will have approximately 3 concurrent users at a given time, and a throughput of 10 GB/day

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Yeah, that looks better. I'm not 100% certain if 16/8 memory distribution is better than 12/12, but changing that is not going to have an enormous impact. More is always better of course, but you should be fine for a pedestrian 10GB/day...

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Yeah, that looks better. I'm not 100% certain if 16/8 memory distribution is better than 12/12, but changing that is not going to have an enormous impact. More is always better of course, but you should be fine for a pedestrian 10GB/day...

aelliott
Motivator

finally have the power to convert to answer 🙂 Thanks for your help martin.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Bear in mind that indexing performance is about 30% slower on a virtual machine. Search performance is about equivalent to physical hardware.

aelliott
Motivator

I have modified my post, does that look much better?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'd swap the cores around, giving the search head more oomph.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...