Just to be clear, the web service still needs a full installation of Splunk, though it would not necessarily perform any indexing. What you're looking for is a dedicated search head.
To get started, look here:
http://www.splunk.com/base/Documentation/4.1.7/Installation/CapacityplanningforalargerSplunkdeployme...
In broad terms, shoot for at least one core per concurrent user, plus another one or two for scheduled search jobs. CPU and RAM will be considerably more important than disk. (Most of the disk load is on indexers, not search heads).
