Single indexer node solutions run the most efficiently. There is no need for duplicated storage. Multi indexer node clusters require additional storage but provide for higher availability and aggregate performance.
Calculate the storage required for a single node storage configuration as follows:
For example, given the following parameters:
Applying the formula above yields the following results:
A Splunk cluster has an additional factor to consider when sizing the needed storage. You choose the replication factor, or number of copies of data. N replicas require N * the storage that is listed above and allow N-1 nodes to fail before losing your data. Installing a cluster with a replication factor of 2 (original + 1 replica) requires twice the storage as calculated above.