Splunk Search

Splunk Storage & Engineering Limits

KarunK
Contributor

Hi All,

Can anyone please advise me regarding the Splunk Engineering limits documents. What i am looking for is :-

  1. How much data the forwarders can handle at a given a point of time ?
  2. How much data can indexers can ingest ?
  3. What is the storage requirements for Splunk ?

etc etc

Thanks in advance.

Tags (3)
1 Solution

ChrisG
Splunk Employee
Splunk Employee

I agree, your questions really pertain to hardware rather than the core software. I suggest you read Hardware capacity planning for your Splunk deployment in the Installation Manual for some guidance.

View solution in original post

tmeader
Contributor

Going by the Splunk guidelines doc is good for a start. We've found that the ability to laterally upgrade by just adding more indexers has been a very viable solution (even if the hardware is not that great). At the moment we're using 4 Indexers that are now over 3 year old hardware, easily handling ~80GB a day. One thing to NOT skimp on is your I/O back-end. Get the fastest disks you possibly can, preferably RAID10.

0 Karma

KarunK
Contributor

Thanks for your Response. Appreciate that.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

I agree, your questions really pertain to hardware rather than the core software. I suggest you read Hardware capacity planning for your Splunk deployment in the Installation Manual for some guidance.

KarunK
Contributor

Thanks for your Response. Appreciate that.

0 Karma

treinke
Builder

I believe this is more a limitation of your hardware than the Splunk software. I personally have easily done 150GB in a day of data. I there are customers out there that are doing around 1TB or more of data a day.

There are no answer without questions
0 Karma

KarunK
Contributor

Thanks for your Response. Appreciate that.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...