Your Browser is Out of Date

ShareDemos uses technology that works best in other browsers.
For a full experience use one of the browsers below
Reference Architecture—Ready Solutions for Data Analytics Splunk Enterprise on Dell Infrastructure
Solution sizing
Overview Ingest rate Compression ratio Retention periods Cluster vs single node Solution storage performance Splunk indexer examples

Solution sizing

Cluster vs single node

  • Single indexer node solutions run the most efficiently. There is no need for duplicated storage. Multi indexer node clusters require additional storage but provide for higher availability and aggregate performance.

    Single node storage

    Calculate the storage required for a single node storage configuration as follows:

    For example, given the following parameters:

    • 100 GB per day ingest rate
    • 0.5 compression rate
    • Two different retention rates:
    • 30 Days Hot/Warm retention
    • 180 Days Cold retention

    Applying the formula above yields the following results:

    Cluster storage

    A Splunk cluster has an additional factor to consider when sizing the needed storage. You choose the replication factor, or number of copies of data. N replicas require N * the storage that is listed above and allow N-1 nodes to fail before losing your data. Installing a cluster with a replication factor of 2 (original + 1 replica) requires twice the storage as calculated above.

next

Solution storage performance