With 10G daily volume you'd be good with running one of those boxes as an all-in-one Splunk, assuming you don't do weird things like a billion users churning through the data all day long. One box with the six drives in RAID10 should give you a retention time of well over a year, more than enough to get started. Sure you could use one as a SH and one as an IDX, but the gain is small for normal situations and somewhat offset by the network between the two. Here's a potentially better alternative: Set up two all-in-one instances with one of them acting as license master for the other. That way you could use one as your testing/sandbox instance and move stuff that's somewhat "done" to the more production-ish instance to keep running without being messed with too much. Additionally, starting with one all-in-one instance keeps things simple and your initial get-go quick. When you either add license volume or run out of space in a year or three you can still consider upgrading your hardware. ... View more