How Splunk apps affect resource requirements
This topic discusses how Splunk apps and solutions affect hardware requirements in a distributed Splunk Enterprise deployment.
If you use a Splunk app or solution that gets knowledge by executing a larger number of saved searches, then you can easily overwhelm a single-server Splunk Enterprise deployment. This is because multiple searches quickly exhaust available CPU resources on an indexer. (Review "Accommodate many simultaneous searches" in this manual for specifics on how Splunk deals with multiple concurrent searches.)
When installing an app or solution, read the system requirements outlined in that app or solution's documentation. If that information is not available, contact the authors of the app or solution to get specific details about what is needed to run the app properly.
Accommodate concurrent users and searches
Summary of performance recommendations
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14