Summary of performance recommendations
The Daily Indexing Volume table summarizes the performance recommendations that were given in the performance questionnaire. The table shows the number of reference machines that you need to index and search data in Splunk Enterprise, depending on the number of concurrent users and the amounts of data that the instance indexes.
An indexer that meets the minimum reference hardware requirements can ingest up to 300 GB/day while supporting a search load. For a review of the current reference hardware specifications, see Reference hardware in this manual.
The table is only a guideline. Modify these figures based on your use case. If you need help defining and scaling a Splunk platform environment, contact your Splunk Sales representative or Professional Services.
| Daily Indexing Volume | |||||||
|---|---|---|---|---|---|---|---|
| < 2 GB/day | 2 to 300 GB/day | 300 to 600 GB/day | 600 GB to 1 TB/day | 1 to 2 TB/day | 2 to 3 TB/day | ||
| Total Users: less than 4 | 1 combined instance | 1 combined instance | 1 Search Head, 2 Indexers |
1 Search Head, 3 Indexers |
1 Search Head, 7 Indexers |
1 Search Head, 10 Indexers | |
| Total Users: up to 8 | 1 combined instance | 1 Search Head, 1 Indexers |
1 Search Head, 2 Indexers |
1 Search Head, 3 Indexers |
1 Search Head, 8 Indexers |
1 Search Head, 12 Indexers | |
| Total Users: up to 16 | 1 Search Head, 1 Indexers |
1 Search Head, 1 Indexers |
1 Search Head, 3 Indexers |
2 Search Heads, 4 Indexers |
2 Search Heads, 10 Indexers |
2 Search Heads, 15 Indexers | |
| Total Users: up to 24 | 1 Search Head, 1 Indexers |
1 Search Head, 2 Indexers |
2 Search Heads, 3 Indexers |
2 Search Heads, 6 Indexers |
2 Search Heads, 12 Indexers |
3 Search Heads, 18 Indexers | |
| Total Users: up to 48 | 1 Search Head, 2 Indexers |
1 Search Head, 2 Indexers |
2 Search Heads, 4 Indexers |
2 Search Heads, 7 Indexers |
3 Search Heads, 14 Indexers |
3 Search Heads, 21 Indexers | |
| Determine when to scale your Splunk Enterprise deployment | Forwarder-to-indexer ratios |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2, 9.4.0
Download manual
Feedback submitted, thanks!