Splunk Search

Search head disk space requirements

cafissimo
Communicator

Hello, please, I would like to know why, for a search head that is on top of two splunk indexers indexing 300 gb/day of data, documentation (http://www.splunk.com/base/Documentation/4.2/Installation/CapacityplanningforalargerSplunkdeployment) says that "2 300 gb hard disks" are needed. Thanks in advance and best regards.

Luca Caldiero Consoft Sistemi S.p.A.

Tags (2)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi cafissimo

a search head needs CPU power more then IO throughput; that's why 2 local disks are enough. the more CPU cores you have in the search head, the more concurrent searches can be run on it.

regards, MuS

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

A search head really doesn't.

MuS
SplunkTrust
SplunkTrust

Hi cafissimo

a search head needs CPU power more then IO throughput; that's why 2 local disks are enough. the more CPU cores you have in the search head, the more concurrent searches can be run on it.

regards, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...