Splunk Dev

Need a suggestion for implementing multi -site search factor ?

karthikeyan_k14
New Member

Hi All, Could any one guide us on the below requirement, as we need to finalize the infra setup for splunk.

Currently we have t*wo site located in two places with 3 nodes on each site*, so before going for the implementation we had question from Infra (storage team) for storage sizing. As it is multi site clustering could you please let us know what type of search factor and replication factor value should be suggested, so that based on that we can recommend the storage size to the infra team.

As per splunk document by default the site search factor is 2 and replication factor is 3, in the sense there were be two copies in one site and one copy at another site. In this case what will be storage sizing of each index node at each site.

Currently we have 60 GB of data being injected in index.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Sitesearchfactor

Tags (1)
0 Karma

lguinn2
Legend

You might want to play around with the sizing tool at http://splunk-sizing.appspot.com/
This is not published by Splunk, but it will give you an estimate.
The replication factor and search factor should be chosen based on the business case: how much risk can the business take vs. how much money can be spent on disk? The more copies, the less risk but larger storage costs. The Splunk defaults are a good starting point.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...