Splunk Enterprise Security

How to size Splunk deployment for 1800 clients

georgemak
Engager

Hello,

I've been using Splunk for less than a year and I'm trying to know how to size Splunk deployment(hardware requirement). I've read the Splunk Capacity Planning manual and the admin guides but would like to hear from people who have done it.

  • 1800 clients in the environment
  • 120GB/day(Splunk)

So How many indexers and forwarders should I have for this project? as I have 1800 clients and using 120GB a day.
Can one server do the job?
Also, I am not sure if I should use universal or Heavy forwarder. But it seems like Universal is the right one.

I'd appreciate any recommendations.

Thanks in advance,
George

0 Karma
1 Solution

vliggio
Communicator

Clients should definitely use the universal forwarder (UF). There are a few cases where you need to use the heavy forwarder, but in general, you would use the UF for normal clients where you're collecting logs and metrics from.

A single properly configured indexer can handle 120gb/day easily, depending on the storage type and your search volume. If you are running special applications such as Enterprise Security, you might need more horsepower, or if you have a large number of end users doing searching (and who are not well versed at Splunk searching, meaning they will write bad searches which consume a lot of resources).

Also, depending on how important you consider your data, you might want several indexers so you can do replication of your data.

View solution in original post

vliggio
Communicator

Clients should definitely use the universal forwarder (UF). There are a few cases where you need to use the heavy forwarder, but in general, you would use the UF for normal clients where you're collecting logs and metrics from.

A single properly configured indexer can handle 120gb/day easily, depending on the storage type and your search volume. If you are running special applications such as Enterprise Security, you might need more horsepower, or if you have a large number of end users doing searching (and who are not well versed at Splunk searching, meaning they will write bad searches which consume a lot of resources).

Also, depending on how important you consider your data, you might want several indexers so you can do replication of your data.

georgemak
Engager

Thank you! it definitely makes sense.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

By "clients" do you mean users or forwarders?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...