This chapter provides details about Splunk Enterprise's deployment, design, and configuration on the Dell EMC HCI VxRail, from a single instance starter kit to a scalable, distributed, cluster environment. This solution covers five types of deployments that address different user scenarios:
- Single Instance 50 GB/day with 90-day Retention—A single instance that combines indexing and search management functions
- Multi-instance 500 GB/day with 90-day Retention—One search head with two indexers
- Multi-instance 1000 GB/day with 90-day Retention—One search head for every five indexers
- Multi-instance 3000 GB/day with > 90-day Retention—One search head for every five indexers, using Isilon to provide configurable retention for Splunk cold buckets
- Multi-instance 5000 GB/day with > 90-day Retention and Indexer High Availability—One search head for every five indexers, including a replication factor of 2 and a search factor of 2, using Isilon to provide configurable retention for Splunk cold buckets