Splunk implementations must be sized to match the specific environment. This appendix provides information about the approaches and calculations that were used to determine the configurations described in this document. You may want to consider them for additional sizing calculations. The major input variables to determine what hardware is required for a specific setting are:

• Ingest rate and retention periods
• Whether you are using a single node solution or a cluster