System requirements for production use

Systems for production must meet or exceed the listed requirements:

System Area	Requirement
Hypervisor for virtual machine images.	VMware vSphere ESX/ESXi 5 or later
Processor	1 server-class CPU, 4 to 8 cores
Memory	Minimum of 16GB RAM, 32GB recommended
Storage	Splunk Phantom needs storage for multiple volumes: PostgreSQL database: 500GB mounted as either /opt/phantom/data or <PHANTOM_HOME>/data Embedded Splunk Enterprise: 500GB mounted as /opt/phantom/data/splunk or <PHANTOM_HOME>/data/splunk File share volumes: 500GB mounted as /opt/phantom/vault or <PHANTOM_HOME>/vault Disk space requirements vary based on the volume of data consumed and the size of your production environment.
Network	A one-gigabit network interface
System utilities	cron On privileged deployments, the phantom user must have permission to create cron jobs. On unprivileged deployments, the user account that runs Splunk Phantom must have permission to create cron jobs. ntp

You might need a larger volume of storage. Using the Splunk Phantom Files feature to store virtual machine snapshots or other large-format data consumes significant storage.