Splunk Enterprise supports three types of deployment:
This document is concerned primarily with the distributed deployment, which consists of:
This document describes systems for three separate ingest rate scenarios and gives options for two different retention periods. Further discussion of sizing for a specific workload may require consideration of additional factors, such as:
These factors affect the number of indexers and search heads to run Splunk Enterprise on Dell EMC Infrastructure efficiently.
See Table 1 for further guidelines on cluster configurations to meet additional scenarios.