Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise Security
- :
- How to size Splunk deployment for 1800 clients
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I've been using Splunk for less than a year and I'm trying to know how to size Splunk deployment(hardware requirement). I've read the Splunk Capacity Planning manual and the admin guides but would like to hear from people who have done it.
- 1800 clients in the environment
- 120GB/day(Splunk)
So How many indexers and forwarders should I have for this project? as I have 1800 clients and using 120GB a day.
Can one server do the job?
Also, I am not sure if I should use universal or Heavy forwarder. But it seems like Universal is the right one.
I'd appreciate any recommendations.
Thanks in advance,
George
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Clients should definitely use the universal forwarder (UF). There are a few cases where you need to use the heavy forwarder, but in general, you would use the UF for normal clients where you're collecting logs and metrics from.
A single properly configured indexer can handle 120gb/day easily, depending on the storage type and your search volume. If you are running special applications such as Enterprise Security, you might need more horsepower, or if you have a large number of end users doing searching (and who are not well versed at Splunk searching, meaning they will write bad searches which consume a lot of resources).
Also, depending on how important you consider your data, you might want several indexers so you can do replication of your data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Clients should definitely use the universal forwarder (UF). There are a few cases where you need to use the heavy forwarder, but in general, you would use the UF for normal clients where you're collecting logs and metrics from.
A single properly configured indexer can handle 120gb/day easily, depending on the storage type and your search volume. If you are running special applications such as Enterprise Security, you might need more horsepower, or if you have a large number of end users doing searching (and who are not well versed at Splunk searching, meaning they will write bad searches which consume a lot of resources).
Also, depending on how important you consider your data, you might want several indexers so you can do replication of your data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you! it definitely makes sense.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
By "clients" do you mean users or forwarders?
If this reply helps you, Karma would be appreciated.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
