What is the recommended hardware Configuration and License requirement for below

[harshal_chakran]

Hi,

I have a requirement in which i'll be receiving around 150 KB file every 15 min from 100,000 terminals
No. of Terminals which send files = 100,000
No. of Files Received per day from one terminal = 96
Approx. size of single file = 150 KB
So total data per day to be indexed = 1440 GB

I wish to know what will be the splunk recommended hardware configuration for the above requirement. Also i wanted to know the cost of per year as well as perpetual license cost for the said requirement.

Also if possible i would like to have the hardware and license cost for both Splunk Enterprise and Splunk Light.

[dwaddle]

As @martin_mueller has suggested, there are a lot of variables to consider here. When you begin looking at sizing anything larger than a couple hundred GB / day, then you should take advantage of Splunk's sales professionals and their training and experience. Those of us in the community have the skill to answer your architecture questions, but there's a lot more to consider than can be laid out and discussed in answers. Plus, you will need them to provide firm pricing information, so you might as well start building the relationship early.

[martin_mueller]

If you put 1.5TB of license on the table building that relationship should be quick and easy 😄

[martin_mueller · Accepted solution]

Splunk Light is out because that's limited to 20GB per day. 1.5TB per day isn't exactly light...

An exact recommendation needs more info, e.g. what kind of data, what searches, how many users, etc. - but I can of course give you a rough idea.

For that amount of data you'll need anywhere between eight and sixteen reference-spec indexers, and one to three reference-spec search heads for non-redundant Splunking. If you need redundancy on the indexer, search head, or both layers you need to factor in several additional boxes.
http://docs.splunk.com/Documentation/Splunk/6.2.3/Capacity/Summaryofperformancerecommendations

For licensing at high volume you'll need to talk to sales. You can get a rough idea from Splunk's pricing page, at 1.5TB the price per GB will obviously be lower than the price per GB for 100GB.
http://www.splunk.com/en_us/products/pricing.html