The next step after calculating license size is to identify how many indexers are necessary for us.
Splunk set up.
Determine the number of indexes is a tricky one.
If you go by documentation of Splunk official documentation, it says single indexer can handle up to
300 GB per day.
I think we all know what's the difference of statement in official documentation of any product and
the actual scenarios that as a consultant or an end user you experience in the field.
Based on my experience, it's good to have additional indexer for every 100 gigs of license.
I've seen environments where one indexer is being choked to death really by.
Just not able to handle 150 to 200 gigs data because it was bombarded with applications, a lot of premium
apps and stuff.
Consider the search loads on the indexer as per my own recommendation or my own experience.
It's good to have one indexer for every hundred GB of data.
For example.
Less than 100 GB.
One indexer.
Should be enough, but greater than 100 and less than 200 or 250 GB.
Go for two indexers and anything greater than 200 and less than 300.
Go for three index and so on.
Make sure you have that.
This is a you have this in mind and this is just a rough estimate.
There is no official recommendation.
But trust me, when you when you go with this process, you will find it.
Your Splunk and own performance will be optimum.
When I say optimum, it responds to you faster rather than having 300 GB of data in a single indexer.
Moving on.
The next step is the remaining search acts.
Calculate the number of searches depending on a number of different factors.
The list varies, let's say, to list few of them.
The number of searchers depends on number of active users, a number of alerts, reports that are scheduled
or real time number of parallel searches, a number of codes available for the search.
Considering these kind of factors, there won't be any clear answers at the beginning for you.
You consider if you have more than eight users, go for additional searches.
So let's say I have 15 users.
I will go for two searches.
I have 24 searches.
I'll go for 324 users.
I'll go for three searches.
So on if less than eight users, one search should be more than sufficient.
Or one more good thing about the search is you can add them any time you need.
There is no need for any downtime or any impact for your existing Splunk environment even.
The Indexer.
Also, you can add to your Splunk environment at any point of time.
There is no actual downtime or disruption in your environment.
These are simple small configuration, which just kills up your environment to the next level.
The surcharge.
You can add them at any moment of time without any impact.
But although I recommend to build a strong base from the beginning in terms of indexes, make sure you
get the number of indexes right because surcharge, you can add indexes when you add a later say, the
data will be shared between two indexes and the data storage will be inconsistent in one index.
Or you might see 100 GB of data.
In other indexes you can see ten GB of data to avoid these kind of data storage imbalance, it's better
to build a strong base foundation for your indexes.
The next step in designing the architecture is to evaluate the need for a V forwarders deployment service
license manager.
As we all know by now.
These three components are optional components.
We know what functionalities these components are used for.
So as a Splunk architect, it will be your responsibility to choose whether to have this component and
the architecture or not.