I have a customer who has moved off Intel's Xeon to AMD's Epyc CPUs for their server hardware refresh. Currently their 3 node Search Head Cluster (SHC) sit on EPYC 7502P (32C/64T), 512GB of RAM, 2x 500GB RAID1 SSD servers. Indexers are being migrated to EPYC 7402P (24C/48T) 512GB of RAM, 2x 500GB RAID1 SSD (OS/Splunk), Intel 905P 960GB Optane AIC (hot/warm buckets) and some kind of all SSD storage array. In the end the indexers will go from 6 Intel Xeon-based ones to 4 Epyc Servers.
He noted the massive cost savings going to AMD was a no-brainer and will continue to completely discontinue the use of Intel Xeons in all of their data centers. As for performance, they are coming from 2016/2017 era Broadwell-based Xeons and so far the Epyc CPUs are crushing the Intel counterparts in both single threaded and multithreaded performance. The quote from his server vendor for the Core for Core pricing between Intel and AMD was almost 3.5x more expensive going with Intel.
He sent me this as a comparison of price/performance between Xeon and Epyc: https://www.servethehome.com/amd-epyc-7002-sku-list-and-value-analysis/
As a former IT Manager and Splunk customer, I would steer clear of Intel CPUs for pricing and security concerns.
For the OS, all are running CentOS 8 with the recommended Splunk Linux tuning provided in the docs.
