Splunk Enterprise Security

How to size Splunk deployment for 1800 clients

georgemak
Engager

Hello,

I've been using Splunk for less than a year and I'm trying to know how to size Splunk deployment(hardware requirement). I've read the Splunk Capacity Planning manual and the admin guides but would like to hear from people who have done it.

  • 1800 clients in the environment
  • 120GB/day(Splunk)

So How many indexers and forwarders should I have for this project? as I have 1800 clients and using 120GB a day.
Can one server do the job?
Also, I am not sure if I should use universal or Heavy forwarder. But it seems like Universal is the right one.

I'd appreciate any recommendations.

Thanks in advance,
George

0 Karma
1 Solution

vliggio
Communicator

Clients should definitely use the universal forwarder (UF). There are a few cases where you need to use the heavy forwarder, but in general, you would use the UF for normal clients where you're collecting logs and metrics from.

A single properly configured indexer can handle 120gb/day easily, depending on the storage type and your search volume. If you are running special applications such as Enterprise Security, you might need more horsepower, or if you have a large number of end users doing searching (and who are not well versed at Splunk searching, meaning they will write bad searches which consume a lot of resources).

Also, depending on how important you consider your data, you might want several indexers so you can do replication of your data.

View solution in original post

vliggio
Communicator

Clients should definitely use the universal forwarder (UF). There are a few cases where you need to use the heavy forwarder, but in general, you would use the UF for normal clients where you're collecting logs and metrics from.

A single properly configured indexer can handle 120gb/day easily, depending on the storage type and your search volume. If you are running special applications such as Enterprise Security, you might need more horsepower, or if you have a large number of end users doing searching (and who are not well versed at Splunk searching, meaning they will write bad searches which consume a lot of resources).

Also, depending on how important you consider your data, you might want several indexers so you can do replication of your data.

georgemak
Engager

Thank you! it definitely makes sense.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

By "clients" do you mean users or forwarders?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...