uberAgent

Splunk Sizing Resources and Recommendations

October 2, 2024

Contributed by:

Sizing Splunk is not always trivial, especially if it is used for other use cases in addition to uberAgent. We generally recommend working with one of our partners.

That being said, this page lists some basic recommendations as well as resources that should help with sizing Splunk. Before we start, please keep in mind that the only generic answer any good consultant will give is: "it depends". Because it does.

Splunk Sizing Considerations

Hardware Resources: CPU and Disk

Splunk needs CPU and disk resources, RAM not so much (compared to some other workloads). Make sure you have enough disk space for the planned retention time as well as a disk subsystem that delivers good IOPS numbers.

Accelerated Data Model

uberAgent’s Splunk app makes use of an accelerated data model which speeds up searches by about 50-100x. The data model’s high-performance analytics store (HPAS) is located on the indexers. Generating the HPAS incurs some additional indexer CPU load and requires additional disk storage.

Heavy Forwarders

Splunk Heavy Forwarders (HFs) can often be a useful third tier, logically situated between the uberAgent endpoints and the Splunk indexers. If you are deploying uberAgent to tens of thousands of endpoints, keep in mind that high numbers of simultaneous network connections may place a significant load on the HFs. Monitor heavy forwarder performance and be prepared to scale out.

Splunk Sizing Recommendations

Always start with a PoC and closely monitor Splunk performance during that phase.
Measure uberAgent’s data volume, keeping in mind that optimization is often possible.
Due to the accelerated data model, uberAgent’s Splunk load profile is somewhat similar to Splunk’s Enterprise Security (ES) app. When looking at sizing guides, base your calculations on the ES use case.

Splunk Sizing Resources

Splunk’s Capacity Planning Manual and its chapter on reference hardware and its summary of performance recommendations
The deployment planning chapter from Splunk’s Enterprise Security installation and upgrade manual
Splunk’s unofficial storage sizing calculator
Hurricane Labs’ Splunking Responsibly blog series. Part 1: considerations for managing limited system resources and Part 2: sizing your storage
Aplura’s Splunk best practices

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Splunk Sizing Resources and Recommendations

October 2, 2024

Contributed by:

October 2, 2024

Contributed by:

Splunk Sizing Resources and Recommendations

Splunk Sizing Considerations

Hardware Resources: CPU and Disk

Accelerated Data Model

Heavy Forwarders

Splunk Sizing Recommendations

Splunk Sizing Resources

In this article