Splunk Enterprise Security

What are the minimum search head disk space requirements for ES 3.0 and Splunk?

aelliott
Motivator

We will have 2 search heads, one for ES 3.0 and one for Regular splunk.

According to the documentation for 3.0, tsidx files are stored on the Indexer and not the search head.

We are planning on having all summary indexes stored on the indexer.
What is the Disk space required for these search head instances and will they grow based on data throughput into the indexer?

I read that 2 300 GB drives were best, however that seems a bit excessive to me. Disk space is not cheap.
Our search heads will be virtualized in a data center.

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

hi,

There are very few summary indexes left in ES 3.0; they'll be on the search head unless you specifically push them out with an indexes.conf. There are also some lookups which can grow to significant size (threat lists, assets, identities, and their internal representations).

At the end of the day, you'll need to estimate based on data ingest rates, retention times, and environment size though.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

hi,

There are very few summary indexes left in ES 3.0; they'll be on the search head unless you specifically push them out with an indexes.conf. There are also some lookups which can grow to significant size (threat lists, assets, identities, and their internal representations).

At the end of the day, you'll need to estimate based on data ingest rates, retention times, and environment size though.

aelliott
Motivator

and why 2 300 gb as opposed to 1 600 gb

0 Karma

aelliott
Motivator

i'd also like to know the "disk" space of a Deployment Server. I know it doesn't need "much" but that is not very specific. We plan on having thousands of devices connected to it.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...