We plan on moving to a clustered environment soon, so we are starting to dive into what we need storage wise. Based off Splunk documentation:(http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Systemrequirements) we will need about one terabyte added to accommodate for all our hot buckets. I would like to make sure these numbers are correct.
Examples:
• 3 peer nodes, with replication factor = 3; search factor = 2: This requires a total of 115GB across all peer nodes (averaging 38GB/peer), calculated as follows:
o Total rawdata = ( `15GB * 3`) = 45GB.
o Total index files = ( `35GB * 2`) = 70 GB.
• 5 peer nodes, with replication factor = 5; search factor = 3: This requires a total of 180GB across all peer nodes (averaging 36GB/peer), calculated as follows:
o Total rawdata = ( `15GB * 5`) = 75GB.
o Total index files = ( `35GB * 3`) = 105 GB.
Our planned environment-
Peers: 4
Replication: 4
Search factor: 2
We have about 960gb of hot buckets-
~960GB / 2 = 480GB
144GB Raw Data
336GB Assoc Index FIles
RawData ( `144 * 4`) = 576GB
Index Files ( `336 * 2`) = 672GB
I wanted to make sure this is true and sounds correct that we will need an additional 1248GB per indexer?
http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Systemrequirements
↧