Single indexer node solutions run the most efficiently. There is no need for duplicated storage. Multi indexer node clusters require additional storage but provide for higher availability and aggregate performance.

Single node storage

Calculate the storage required for a single node storage configuration as follows:

For example, given the following parameters:

• 100 GB per day ingest rate
• 0.5 compression rate
• Two different retention rates:

• 30 Days Hot/Warm retention
• 180 Days Cold retention

Applying the formula above yields the following results:

Cluster storage

A Splunk cluster has an additional factor to consider when sizing the needed storage. You choose the replication factor, or number of copies of data. N replicas require N * the storage that is listed above and allow N-1 nodes to fail before losing your data. Installing a cluster with a replication factor of 2 (original + 1 replica) requires twice the storage as calculated above.