Splunk Enterprise Security

What are the minimum search head disk space requirements for ES 3.0 and Splunk?

aelliott
Motivator

We will have 2 search heads, one for ES 3.0 and one for Regular splunk.

According to the documentation for 3.0, tsidx files are stored on the Indexer and not the search head.

We are planning on having all summary indexes stored on the indexer.
What is the Disk space required for these search head instances and will they grow based on data throughput into the indexer?

I read that 2 300 GB drives were best, however that seems a bit excessive to me. Disk space is not cheap.
Our search heads will be virtualized in a data center.

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

hi,

There are very few summary indexes left in ES 3.0; they'll be on the search head unless you specifically push them out with an indexes.conf. There are also some lookups which can grow to significant size (threat lists, assets, identities, and their internal representations).

At the end of the day, you'll need to estimate based on data ingest rates, retention times, and environment size though.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

hi,

There are very few summary indexes left in ES 3.0; they'll be on the search head unless you specifically push them out with an indexes.conf. There are also some lookups which can grow to significant size (threat lists, assets, identities, and their internal representations).

At the end of the day, you'll need to estimate based on data ingest rates, retention times, and environment size though.

aelliott
Motivator

and why 2 300 gb as opposed to 1 600 gb

0 Karma

aelliott
Motivator

i'd also like to know the "disk" space of a Deployment Server. I know it doesn't need "much" but that is not very specific. We plan on having thousands of devices connected to it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...