It's much more efficient and much more meaningful to create using Splunk icons for this exercise, I
have created considering three scenarios like small enterprise, medium enterprise and large enterprise.
And the last one is the crazy one which involves high availability and clustering architecture.
We'll go through them one by one.
Before going to that.
We are a few more things to sort it out.
Let's learn those things.
That is the of licence calculation, which is one of the.
Crucial things in designing any architecture.
The crucial step of any Splunk implementation.
When I say any Splunk, it can be small.
Medium or large enterprise is to estimate how much license you need.
This is by far the difficult step in designing the architecture because there is no straight answer
saying I need 100 GB, 200 GB.
That can never be a straight answer for how much data we are estimating from data sources because as
we all know, in some scenarios there will be a log spike because of any error or application crashing.
We'll see how we can best estimate our log size in our environment.
This step as a Splunk admin or an architect needs you to interact with other teams and ask them What
is the log size or the data size for yesterday?
If they provide well and good.
Next, ask them how many devices should be integrated.
With your Splunk, you will get a rough estimate.
Keep that number.
It's not over yet.
You got from one team.
Repeat the same step with other teams in the organization like Network for the Syslog Inputs and flash
files for either system, team or server teams for their data and even database team.
After adding up all the numbers, let's say you come to a conclusion of 100 GB, 100 GB per day data.
But based on my experience, it's better to not to go for exact trigger of what we have calculated.
It's good to take 10 to 20% buffer so that any spike in logs should be manageable and should be well
under our limit.
Now to conclude, after discussing and agreeing with all the teams, we can come to a rough estimate
of probably 120 GB of data, including our buffer.