Splunk Enterprise Security

What are the minimum search head disk space requirements for ES 3.0 and Splunk?

aelliott
Motivator

We will have 2 search heads, one for ES 3.0 and one for Regular splunk.

According to the documentation for 3.0, tsidx files are stored on the Indexer and not the search head.

We are planning on having all summary indexes stored on the indexer.
What is the Disk space required for these search head instances and will they grow based on data throughput into the indexer?

I read that 2 300 GB drives were best, however that seems a bit excessive to me. Disk space is not cheap.
Our search heads will be virtualized in a data center.

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

hi,

There are very few summary indexes left in ES 3.0; they'll be on the search head unless you specifically push them out with an indexes.conf. There are also some lookups which can grow to significant size (threat lists, assets, identities, and their internal representations).

At the end of the day, you'll need to estimate based on data ingest rates, retention times, and environment size though.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

hi,

There are very few summary indexes left in ES 3.0; they'll be on the search head unless you specifically push them out with an indexes.conf. There are also some lookups which can grow to significant size (threat lists, assets, identities, and their internal representations).

At the end of the day, you'll need to estimate based on data ingest rates, retention times, and environment size though.

aelliott
Motivator

and why 2 300 gb as opposed to 1 600 gb

0 Karma

aelliott
Motivator

i'd also like to know the "disk" space of a Deployment Server. I know it doesn't need "much" but that is not very specific. We plan on having thousands of devices connected to it.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...