Minimum specifications for a production deployment

Splunk Enterprise Security has some minimum software and hardware requirements that you can increase according to your needs and usage. These specifications also apply to a single instance deployment of Splunk Enterprise Security.

The following table displays the minimum system and hardware requirements to install Splunk Enterprise Security:

Machine role	Minimum CPU	Minimum RAM	Minimum vCPU
Search head	16 physical CPU cores	32 GB	32 vCPU
Indexer	16 physical CPU cores	32 GB	32 vCPU

The minimum hardware specifications to run Splunk Enterprise Security for search head cluster peers is the same as those required by standalone deployments.

Splunk Enterprise Security stores some lookup files in a key-value store (KV Store).

See also

For more information about system requirements for KV Stores and other deployment considerations, see the product documentation:

• About the app key value store in the Splunk Enterprise Admin Manual
• Deployment considerations for Splunk Enterprise Security