Determine when to scale your Splunk Enterprise deployment

Before you consider when and how to scale your environment, estimate how much data you need to index, and how many users are searching that data.

Performance questionnaire

This questionnaire begins with a single-instance Splunk Enterprise deployment based on the reference architecture described in the Reference machine for single-instance deployments topic. These guidelines help you decide when to distribute your Splunk platform deployment.

Question 2: Do you need more than two users signed in at one time?

If you answer No to questions 1 and 2, then your Splunk platform instance can share a reference machine for distributed deployments with other Splunk platform services.

If you answer Yes to question 1 or 2, then proceed to Question 3.

Note When deploying Splunk Enterprise on Windows OS, do not utilize a host that provides Active Directory or Exchange services, or runs machine virtualization software. Those services are I/O intensive and can reduce Splunk Enterprise indexing and search performance.

Question 4: Do you need more than four concurrent users?

If you answer No to questions 3 and 4, then a single dedicated Splunk Enterprise instance running on a reference machine can provide sufficient resources for the indexing and search workload. Go to Question 5.

If you answer Yes to question 3 or 4, then scale your Splunk Enterprise deployment to multiple machines to handle the increased demand of indexing and searching. Go to Question 5.

Question 5: Do you need more than 600GB of total storage?

See How Splunk Enterprise calculates disk storage.

If you answer No, then a single dedicated reference machine should be able to handle indexing and search workload, but you can consider adding additional storage to the machine to account for increased disk usage due to higher retention. Go to Question 6.

If you answer Yes, then scale your Splunk Enterprise deployment to multiple machines to handle the increased demand of indexing and searching. Go to Question 6.

Question 7: Do you need to search large quantities of data for a small set (less than 1 per cent) of results?

If you answer No to questions 6 and 7, you might not require multiple indexers in your Splunk Enterprise deployment at this time.

If you answer Yes to questions 6 or 7, then scale your Splunk Enterprise deployment to multiple machines to handle the increased demand of indexing and searching.