Capacity planning for index server + search head

New Member


With index volume less than 2GB/day but 4-8 conncurrent and scheduled tasks, what's the reasonable hardware spec for index server and search head - we want to seperate index server and search head.



Tags (1)
0 Karma


Hi David,

Have a look right here: Min. Requirement or here: Capacity Planning

In your case, some 1 CPU (2-4 Core) and 4-8 GB RAM do the job for both. The more cores/RAM you have, the better of course 😉 Note: Don't forget to have a look on your disks (RAID 10) as well!

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!