Need a suggestion for implementing multi -site search factor ?

[karthikeyan_k14]

Hi All, Could any one guide us on the below requirement, as we need to finalize the infra setup for splunk.

Currently we have t*wo site located in two places with 3 nodes on each site*, so before going for the implementation we had question from Infra (storage team) for storage sizing. As it is multi site clustering could you please let us know what type of search factor and replication factor value should be suggested, so that based on that we can recommend the storage size to the infra team.

As per splunk document by default the site search factor is 2 and replication factor is 3, in the sense there were be two copies in one site and one copy at another site. In this case what will be storage sizing of each index node at each site.

Currently we have 60 GB of data being injected in index.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Sitesearchfactor

[lguinn2]

You might want to play around with the sizing tool at http://splunk-sizing.appspot.com/
This is not published by Splunk, but it will give you an estimate.
The replication factor and search factor should be chosen based on the business case: how much risk can the business take vs. how much money can be spent on disk? The more copies, the less risk but larger storage costs. The Splunk defaults are a good starting point.