Is there a sizing guide for the number of Enterprise Security search heads to contain in a cluster?

[hurricane13]

Hi all,

As the question states, is there a sizing guide for how many members I should include in a ES SHC? I am trying to size an environment that is equal to 5 TB a day for 50 indexers (per the 100 GB/day). For users I am assuming 20 and searches at 200.

Also, would the value scale linearly per the number of users or correlation searches?

I have used the following performance recommendations summary for capacity planning in the past to help with sizing for Splunk Enterprise without ES however does it also apply to ES?

docs.splunk.com/Documentation/Splunk/7.2.1/Capacity/Summaryofperformancerecommendations

[woodcock]

The problem is not with ES but with SHC, more specifically, with the KV Store. The replication is fragile and prone to breakdowns and losing sync. During this situation is is common for it to become corrupt and unrecoverable. it is also common for recovery steps to result in permanent corruption/loss. In some environments, this is merely easily reproducible lookups, but in ES, the KVStore contains most of your configurations, customizations, and history, including your incidents, and glass tables. So if you lose KVStore, you lose almost EVERYTHING and have to start from scratch. This is too big a risk to make SHC on ES sensible except in the most dire situations, and even then a strict KVStore backup regimen must be put in place AND TESTED!!!

[dkeck]

Hi,

from my understanding the number of SHC members is based on this:

http://docs.splunk.com/Documentation/Splunk/7.2.1/DistSearch/SHCsystemrequirements#Required_number_o...

There is no hint that ES SHC will differs. Its linked from here : http://docs.splunk.com/Documentation/ES/5.2.0/Install/DeploymentPlanning#Splunk_Enterprise_Security_...

[prakash007]

How about this doc..

http://docs.splunk.com/Documentation/ES/5.2.0/Install/DeploymentPlanning

[hurricane13]

Thanks for that. I had already looked at that and it unfortunately doesn't get to the heart of my question which is, how many members I would need? Is there a pseudo guideline that says "if I am using 5 SH to happily run my use cases and then I add ES in a new SHC, I should have X+2 search heads in that ES cluster"?.