Splunk Enterprise

What are the IOPS requirement for Splunk Light?

mjung
New Member

Hello,

I have been looking around this site and in the official documentation for sizing information on Splunk Light. I have not been able to find any specific recommendations for Splunk Light (most of the recommendations seem to be for Enterprise). I need to deploy a very low volume Splunk Light instance (beginning with the 1GB per day indexing volume).

I want to deploy this on new storage however we do not have capacity on the production Compellent SAN. I'm considering using a relatively inexpensive storage appliance such as the Buffalo TeraStation™ 5000N WSS Series. This is not great from an IO perspective...it maxes out at 6 SATA drives. However, I am wondering if this will be sufficient for the low amount of indexing we need to do. Surely the recommendations of 800 or 1200 IOPS for a full Splunk Enterprise indexer would be lower for our use case? But I cannot find any data on this.

Second, we are considering this type of appliance running Windows Storage Server and would probably run Splunk directly on the WSS operating system on this appliance. Any considerations with this?

Any feedback would be appreciated. Thanks!

0 Karma

jterry
Splunk Employee
Splunk Employee

Officially, Light has the same requirements as a single-instance configuration of Enterprise. That said however, you could just give it a try & see how it goes.

0 Karma

ChrisG
Splunk Employee
Splunk Employee
0 Karma

jkat54
SplunkTrust
SplunkTrust

I wouldnt be worried about IOPS with 1gb/day input. However, I might be worried about it as it relates to how fast search will be. If it's ok for you to have slow searching, reporting, alerting, etc.., then go for it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...