Splunk Search

Search head disk space requirements

Communicator

Hello, please, I would like to know why, for a search head that is on top of two splunk indexers indexing 300 gb/day of data, documentation (http://www.splunk.com/base/Documentation/4.2/Installation/CapacityplanningforalargerSplunkdeployment) says that "2 300 gb hard disks" are needed. Thanks in advance and best regards.

Luca Caldiero Consoft Sistemi S.p.A.

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

Hi cafissimo

a search head needs CPU power more then IO throughput; that's why 2 local disks are enough. the more CPU cores you have in the search head, the more concurrent searches can be run on it.

regards, MuS

View solution in original post

Splunk Employee
Splunk Employee

A search head really doesn't.

SplunkTrust
SplunkTrust

Hi cafissimo

a search head needs CPU power more then IO throughput; that's why 2 local disks are enough. the more CPU cores you have in the search head, the more concurrent searches can be run on it.

regards, MuS

View solution in original post