How to size Splunk deployment for 1800 clients

[georgemak]

Hello,

I've been using Splunk for less than a year and I'm trying to know how to size Splunk deployment(hardware requirement). I've read the Splunk Capacity Planning manual and the admin guides but would like to hear from people who have done it.

• 1800 clients in the environment
• 120GB/day(Splunk)

So How many indexers and forwarders should I have for this project? as I have 1800 clients and using 120GB a day.
Can one server do the job?
Also, I am not sure if I should use universal or Heavy forwarder. But it seems like Universal is the right one.

I'd appreciate any recommendations.

Thanks in advance,
George

[vliggio · Accepted solution]

Clients should definitely use the universal forwarder (UF). There are a few cases where you need to use the heavy forwarder, but in general, you would use the UF for normal clients where you're collecting logs and metrics from.

A single properly configured indexer can handle 120gb/day easily, depending on the storage type and your search volume. If you are running special applications such as Enterprise Security, you might need more horsepower, or if you have a large number of end users doing searching (and who are not well versed at Splunk searching, meaning they will write bad searches which consume a lot of resources).

Also, depending on how important you consider your data, you might want several indexers so you can do replication of your data.

[georgemak]

Thank you! it definitely makes sense.

[richgalloway]

By "clients" do you mean users or forwarders?