Recommended architecture for my specifications?

[splunkcol]

Hello,

I currently have an intake that is exceeding 100GB per day and I would like to know what are the best practice recommendations to support this intake without affecting performance.

How many servers or indexers are needed and their minimum and recommended specifications?

[gcusello · Accepted solution]

i @splunkcol,

if you haven't apps like ES or ITSI, one server can usually index and make usable until 200 GB/day.

The number of servers depends on this factor and also on others like:

• HA: yes or not,
• number of concurrent users,
• number of scheduled searches.

So, with your indexing volume and a normal number of users and scheduled searches, you can have one or two servers depending on HA.

Ciao.

Giuseppe