Splunk® Enterprise

Distributed Deployment Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Summary of performance recommendations

The table below depicts the performance recommendations based on the reference servers described earlier in this chapter. For specifics on those reference servers, read "Reference hardware."

Important: The table shows approximate guidelines only. You should modify these figures based on your specific use case. If you need additional guidance, contact Splunk. You might want to engage a member of Professional Services depending on the deployment's initial size.

Daily Volume Number of Search Users Recommended Indexers Recommended Search Heads
< 2 GB/day < 2 1, shared N/A
2 to 100 GB/day up to 4 1, dedicated N/A
100 to 200 GB/day up to 8 2 1
200 to 300 GB/day up to 12 3 1
300 to 400 GB/day up to 8 4 1
400 to 500 GB/day up to 16 5 2
500 GB to 1 TB/day up to 24 10 2
1 TB to 20 TB/day up to 100 100 24
20 TB to 60 TB/day up to 100 300 32


Have questions? Visit Splunk Answers to see what questions and answers other users had about hardware and Splunk Enterprise.

How Splunk apps affect resource requirements
Upgrade your distributed environment

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15


In Row 2 of the table, with "Recommended Indexers" being mentioned as "1, dedicated", "Recommended Search Heads" should also be "1" instead of "N/A".

March 17, 2014

Should there also be a column discussing concurrent searches? Or maybe it could replace the concurrent users column? We have many scheduled searches that effectively run all the time.

January 30, 2014

It would be nice to see similar recommendations for low daily volumes (100-200 and high number of search users (100+), instead of them both increasing.

October 21, 2013

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters