As part of our journey of designing the best architecture for our organisation, the next step is.
Understanding the hardware specification required for our Splunk components.
The link specified here.
And that document should be able to take you directly.
Let me show you.
The contents of these.
So that you will have better understanding.
These are the hardware recommendations that are recommended by Splunk.
The link should be able to take you directly into the requirements page, which shows the recommended
hardware specification.
These are for UNIX operating system.
Now.
Let us go through them one by one.
Let us start from looking by search your perspective.
Depending on, let's say, small, medium or large enterprise.
The number of calls for Splunk varies from 2 to 64 cores at two gigahertz, depending upon the size
of the architecture.
It's like the well goes for small enterprise and 64 core for a large enterprise.
For the searcher, the more cores the better, because each core or it is core intensive.
The search are whenever you run a search.
It mainly relies on the available cores on that.
Search it.
It's better to have.
The model number, of course, for that search it.
I'm looking at Indexer Hardware.
It is highly critical to get.
Minimum are more than 200 IOPS.
Diapers should be more for the indexes since the more IOPS, the better the performance of your indexer.
Always remember never to compromise on IOPS.
That is your input operation input output operations per second.
Since it is one of the critical values for the performance of your entire Splunk environment.
Moving on to the next value is the storage from our previous discussions.
We know how to get an estimated storage for our indexes.
Now we need to understand what grade level is required or recommended by Splunk to run at optimum performance.
It is highly recommended to rate ten for better performance.
But if you are able to get a IOPS condition, we should be fine with rate five or rate six.
The next step is the RAM specification, which depends again on the size of the deployment, considering
it's a small, medium or large on the system.
The RAM can vary from 2 to 64 GB similar to the course that we are considered earlier for the scale
of the deployment.
It's always better to go for the maximum available RAM since you will notice Splunk will be acting like
a monster.
It will be eating up all the resources that it can get its hands on.
And this can be tuned to run at optimum performance by a Splunk admin or Splunk architect.
And also, there are a couple of prerequisites.
For Splunk, which should be taken care as part of infrastructure provisioning or before installation.
Those are your limits.
As per Splunk recommendations, there are a couple of limits that need to be specified at the highest
level so that Splunk operates at optimum performance and also SC Linux are known as Secure Linux and
Linux platform.
It should be disabled or should be made to allow Splunk to run outside C, Linux and DHP, which stands
for Transparent Huge Pages, which is known to cause issues while running Splunk.
So it is recommended by Splunk to disable these processes before installation.