What are the IOPS requirement for Splunk Light?

[mjung]

Hello,

I have been looking around this site and in the official documentation for sizing information on Splunk Light. I have not been able to find any specific recommendations for Splunk Light (most of the recommendations seem to be for Enterprise). I need to deploy a very low volume Splunk Light instance (beginning with the 1GB per day indexing volume).

I want to deploy this on new storage however we do not have capacity on the production Compellent SAN. I'm considering using a relatively inexpensive storage appliance such as the Buffalo TeraStation™ 5000N WSS Series. This is not great from an IO perspective...it maxes out at 6 SATA drives. However, I am wondering if this will be sufficient for the low amount of indexing we need to do. Surely the recommendations of 800 or 1200 IOPS for a full Splunk Enterprise indexer would be lower for our use case? But I cannot find any data on this.

Second, we are considering this type of appliance running Windows Storage Server and would probably run Splunk directly on the WSS operating system on this appliance. Any considerations with this?

Any feedback would be appreciated. Thanks!

[jterry]

Officially, Light has the same requirements as a single-instance configuration of Enterprise. That said however, you could just give it a try & see how it goes.

[ChrisG]

Here is the link to the reference hardware for single-instance deployments.

[jkat54]

I wouldnt be worried about IOPS with 1gb/day input. However, I might be worried about it as it relates to how fast search will be. If it's ok for you to have slow searching, reporting, alerting, etc.., then go for it.