Resource Planning • Room 1

Hardware Sizing

Splunk provides reference hardware guidelines: Indexers need high disk I/O (12+ cores, 12 GB RAM per indexer, fast disks). Search Heads need high CPU and RAM (16+ cores, 12-32 GB RAM) for concurrent search processing.

The general rule of thumb: 1 indexer per ~150-300 GB/day of ingestion, depending on search load and compression ratios.

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Drag items to their correct zone (or tap item then tap zone on mobile)

Needs high disk I/O throughput (sequential writes)

Needs high CPU and RAM for concurrent searches

Distributes apps and configs to forwarders

Manages indexer cluster bucket replication

Indexer

Search Head

Deployment Server

Cluster Manager