What are the minimum search head disk space requirements for ES 3.0 and Splunk?

[aelliott]

We will have 2 search heads, one for ES 3.0 and one for Regular splunk.

According to the documentation for 3.0, tsidx files are stored on the Indexer and not the search head.

We are planning on having all summary indexes stored on the indexer.
What is the Disk space required for these search head instances and will they grow based on data throughput into the indexer?

I read that 2 300 GB drives were best, however that seems a bit excessive to me. Disk space is not cheap.
Our search heads will be virtualized in a data center.

[jcoates_splunk · Accepted solution]

hi,

There are very few summary indexes left in ES 3.0; they'll be on the search head unless you specifically push them out with an indexes.conf. There are also some lookups which can grow to significant size (threat lists, assets, identities, and their internal representations).

At the end of the day, you'll need to estimate based on data ingest rates, retention times, and environment size though.

[aelliott]

and why 2 300 gb as opposed to 1 600 gb

[aelliott]

i'd also like to know the "disk" space of a Deployment Server. I know it doesn't need "much" but that is not very specific. We plan on having thousands of devices connected to it.