Notes:
The values in the Quantity column are for Core Splunk, with values in parentheses for Enterprise Security. The ratio is one Search Head per every five indexers for Core Splunk.
The quantity of indexer instances is three times greater if you use Enterprise Security. The values in the Quantity column are for Core Splunk, with values in parentheses for Enterprise Security.
Table 2. Single instance 50 GB/day with 90-day retention deployment on one VxRail node
Single Instance combined search head and indexer | 1 | 32 | 256 GB | 2.2 TB per 90 days | 8.8 TB per year |
Table 3. Multi-instance 500 GB/day with 90-day retention deployment on four VxRail nodes
Search Head | 1 | 32 | 256 GB | | |
Indexer | 2 (5 for ES) | 32 | 256 GB | 22 TB | 88 TB |
Admin Server | 1 | 20 | 256 GB | | |
Table 4. Multi-instance 1000 GB/day with 90-day Hot/Warm and Cold retention with 1-Year retention on Isilon with five VxRail nodes
Search Head | 1 (2 for ES) | 24 | 256 GB | | |
Indexer | 4 (10 for ES) | 24 | 256 GB | 44 TB | 176 TB |
Admin Server | 1 | 20 | 256 GB | | |
Table 5. Multi-instance 3000 GB/day with 90-day Hot/Warm and Cold retention with 1-Year, and indexer high availability Using RF=SF=2 deployment with Isilon on many VxRail nodes
Search Head | 1 (6 for ES) | 36 | 256 GB | | |
Indexer | 12 (30 for ES) | 36 | 256 GB | 264 TB | 1000 TB |
Admin Server | 1 | 20 | 256 GB | | |
Table 6. Multi-instance 5000 GB/day with 90-day Hot/Warm and Cold with 1-Year retention and indexer high availability Using RF=SF=2 deployment with Isilon on many VxRail nodes
Search Head | 3 (10 for ES) | 48 | 256 GB | | |
Indexer | 20 (50 for ES) | 48 | 256 GB | 440 TB | 1700 TB |
Admin Server | 1 | 20 | 256 GB | | |
