Monitoring Splunk

Is there a way to calculate bandwidth requirements for Splunk index replication in a indexer cluster?

Path Finder

Basically this situation is this:

Customer asked what would be their bandwidth requirements for the replication between indexers.

Say if the license size per day is 200GB, with compression roughly 50% indexed data stored should be about 100GB.
now they have 2 indexers in the cluster with repfactor of 2 and search factor of 2.
so my calculation is below (not sure if it is correct)

based on Splunk docs the 50% consist of the below:
15% for the rawdata file.
35% for associated index files.

Total rawdata = (100*0.15)* 2 (this is the rep factor) = 30 GB
Total index files = (100*0.35)* 2 (this is the search factor) = 70 GB

So a total of 100GB of data will be replicated.

for the bandwidth calculation of 100GB per day:
(100/86400)*1024*1024 = 1213.63 KB/s

This is what I have come up with so far. Any advise would be appreciated.
Also what happens if it is a multisite cluster..

Super Champion

have a look at this site
provide your inputs like daily indexing size,no. of indexer etc. and it will calculate required sizing

0 Karma

Path Finder

@493669 Thanks for the quick reply, regarding the sizing I have used this website before.
Sadly however, currently what I need to find out now is the bandwidth requirements for replication of the data not the storage sizing itself. =(

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...