Following table shows the details of compute design for Splunk components.
Table 3. Compute design consideration
Instance role | Quantity | Physical cores | Memory (GB) |
Search Head | 1 | 16 | 96 |
Indexer | 2 | 24 | 96 |
Cluster Master | 1 | 16 | 96 |
Forwarder | 1 | 16 | 96 |
Note 1: Dell recommends to provisioning minimum of 12 cores to SVM for Splunk enterprise deployments.
Note 2: Splunk Enterprise is a resource-intensive. For best performance, do not overcommit vCPU or memory for Splunk instances. When hyper-threading is enabled, allocate the equivalent number of physical cores.