Splunk Enterprise Security
Highlighted

How to size Splunk deployment for 1800 clients

New Member

Hello,

I've been using Splunk for less than a year and I'm trying to know how to size Splunk deployment(hardware requirement). I've read the Splunk Capacity Planning manual and the admin guides but would like to hear from people who have done it.

  • 1800 clients in the environment
  • 120GB/day(Splunk)

So How many indexers and forwarders should I have for this project? as I have 1800 clients and using 120GB a day.
Can one server do the job?
Also, I am not sure if I should use universal or Heavy forwarder. But it seems like Universal is the right one.

I'd appreciate any recommendations.

Thanks in advance,
George

0 Karma
Highlighted

Re: How to size Splunk deployment for 1800 clients

SplunkTrust
SplunkTrust

By "clients" do you mean users or forwarders?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to size Splunk deployment for 1800 clients

Communicator

Clients should definitely use the universal forwarder (UF). There are a few cases where you need to use the heavy forwarder, but in general, you would use the UF for normal clients where you're collecting logs and metrics from.

A single properly configured indexer can handle 120gb/day easily, depending on the storage type and your search volume. If you are running special applications such as Enterprise Security, you might need more horsepower, or if you have a large number of end users doing searching (and who are not well versed at Splunk searching, meaning they will write bad searches which consume a lot of resources).

Also, depending on how important you consider your data, you might want several indexers so you can do replication of your data.

View solution in original post

0 Karma
Highlighted

Re: How to size Splunk deployment for 1800 clients

New Member

Thank you! it definitely makes sense.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.