Splunk Enterprise Security

What are the minimum search head disk space requirements for ES 3.0 and Splunk?

aelliott
Motivator

We will have 2 search heads, one for ES 3.0 and one for Regular splunk.

According to the documentation for 3.0, tsidx files are stored on the Indexer and not the search head.

We are planning on having all summary indexes stored on the indexer.
What is the Disk space required for these search head instances and will they grow based on data throughput into the indexer?

I read that 2 300 GB drives were best, however that seems a bit excessive to me. Disk space is not cheap.
Our search heads will be virtualized in a data center.

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

hi,

There are very few summary indexes left in ES 3.0; they'll be on the search head unless you specifically push them out with an indexes.conf. There are also some lookups which can grow to significant size (threat lists, assets, identities, and their internal representations).

At the end of the day, you'll need to estimate based on data ingest rates, retention times, and environment size though.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

hi,

There are very few summary indexes left in ES 3.0; they'll be on the search head unless you specifically push them out with an indexes.conf. There are also some lookups which can grow to significant size (threat lists, assets, identities, and their internal representations).

At the end of the day, you'll need to estimate based on data ingest rates, retention times, and environment size though.

View solution in original post

aelliott
Motivator

and why 2 300 gb as opposed to 1 600 gb

0 Karma

aelliott
Motivator

i'd also like to know the "disk" space of a Deployment Server. I know it doesn't need "much" but that is not very specific. We plan on having thousands of devices connected to it.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!