Finally, there is one last option which is used for determining your storage.
Till now we are learned license, a license size, number of indexes, number of searches, a B for
the deployment server and a license manager.
Including why we need to clustering and high availability options.
We will now go forward for calculating storage.
The storage is the important part of your indexes and the storage should have always greater than 200
IOPS.
For getting a rough estimate on storage.
For Indexer.
The link mentioned in the document should be.
Take you straight into calculating the index's storage, which has been used by most of the Splunk consultants.
And this is not officially any way connected to Splunk or Splunk authorizers.
You can see it's not supported by Splunk, and it is completely independent, probably built by one
of the Splunk to help other fellow Splunk us.
This is a very good site for getting a rough estimate of storage per index.
Indexer When I say rough estimates, it's accurate.
Like 18 90% does not complete rough.
Okay.
So we are getting like 80 to 90% of accurate storage as of now.
In my whole experience of 4 to 5 years, I've been using this site and I have not face any miscalculations
or misjudgment.
Well, assigning a storage, we can consider that as a good example.
Most of the time when I go to a customer and ask them, What is your block size you need?
They can't understand or they can't give a straight answer from losses.
Few of them, they give us size by events per second because most of the traditional SIM solutions,
they were like queue and let's ask site and logarithm.
They were using IP as though they were familiar with CPS.
They will come back and say to you that I have five K or four K or even two K event.
So what do you do?
You visit the site, check on this box size experiment.
It will give you a rough estimate of how much license you need.
Probably you can go up to 60 gig and in the case of two K.
And if you choose Spike, it'll get around 115 gig.
You can add 10% buffer and you can go up to 130.
This is how you calculate as a r direct and define the.
This is what my licensing I need.
The next concept become is data retention.
This depends on completely your policy.
Let's say I need six months of data.
I'll choose three months or three months cold.
We'll be going through.
What is this?
Hot, cold, archived frozen retention, how to calculate them, how to configure them.
And later part when we dive deep into indexers and see how it operates and stuff.
For now, consider this as the time which you need to keep your data in Splunk.
Let's say I need three plus three, six months of data and we are not going to use any premium maps.
If you use you can choose one of them and considerably the architecture or it recommends like as you
can see, Splunk, Enterprise Security, it's one of the premium apps.
It will recommend 100 GB per indexer.
This should be automatically updated yet.
Here you can see.
It says it requires 5.1 TB storage per indexer.
So totally.
You need like 100 TB.
So here it is saying we need only one indexer, because if you choose Splunk Enterprise, it says maximum
volume per indexer, you can go up to 100 GB.
Will you choose without anything?
So it says it can handle up to 300 GB, but we know how it works.
The storage configuration, if you have like separate volumes mounted for it, you can mention them.
But as of now, the only important number is 10.2 TB.
Your calculated your storage requirement based on EPS, let's say I'll come back.
I have 100 GB of license.
I need six months retention.
I'll come back here and check.
The storage required for indexers is 8.8 TB.
So this is how you calculate the storage requirement for your.
Indexes.