Hello,
I need hardware recommendations for the following scenario:
1 Search Head
Indexer Cluster (search factor 2) (2 members)
1 Master Node
1 Heavy Forwarder (or cluster if possible)
7GB of events per day
50 alarms (no real time)
100 data sources
Also I would like to know if it is possible to have high availability on the heavy forwarders and how can it be achieved.
Thank you very much.
See the Splunk reference hardware specification at http://docs.splunk.com/Documentation/Splunk/6.6.3/Capacity/Referencehardware.
Thank's for your answer.
I've already read that document and it specifies different possible alternatives.
I was wondering if someone who has experience with a similar enviroment that mine, can recommend me based on the experience.
Thank's again
You should be fine going with the lowest specs in the "Reference host specification for distributed deployments" section. Treat your Master Node and Heavy Forwarder as search heads.
Thank you very much