Splunk Sizing Made Easy

Back in 2013, Mustafa wrote a post describing how to Estimate disk storage required for Splunk Index.

These calculations can sometimes get a bit complicated, so I created simple web-based Splunk storage sizing tool that implements Mustafa’s calculation in the background and puts a nice user interface on top of it. Check it out: http://splunk-sizing.appspot.com/

To use the tool, enter your storage requirements and the tool will estimate the storage required. Plus it can calculate the number of disks you would need per indexer, based on the type of RAID and size of disks you prefer. And it allows you to specify on which volume to store the hot/warm, cold and frozen buckets. E.g. you can store hot/warm buckets on fast RAID and the cold buckets on a cheaper storage.

Another nice feature is the generation of the index configuration file (indexes.conf). This updates in real-time: So all you need to do is set the configuration you want, and the example configuration file updated automatically. When you get a sizing configuration that looks like what you need, you can copy the browser URL string and share that with colleagues.

Of course, this cannot provide a 100% accurate prediction of storage requirements. E.g. at the moment it doesn’t consider disk space required for data model acceleration and doesn’t consider increased indexer CPU and IOPS requirements due to large number of searches. So, you should get the results carefully before buying hardware! However, this little tool should give you a good idea about your Splunk storage requirements.

I hope you like it and happy sizing!

What is the difference between the “Storage Configuration”/”Buckets Storage Type”/”hot warm”/”detailed” Volume 2 and Volume 3 drop down do? All I can see is that it changes the title in the “detailed storage” section.

Lucas K
February 18, 2015

Hi Lucas, the “Storage Configuration” sections allows you to configure which buckets to store on which disk volume. Based on that configuration, a number of “Detailed Storage…” sections will appear or disappear below. E.g. if you choose to store “Hot, Warm” and “Cold” buckets on “Volume 1” and “Archived” on “Volume 2”, then two sections will appear: “Detailed Storage on Volume 1 for Hot, Warm, Cold Buckets” and “Detailed Storage on Volume 2 for Archived Buckets”. In case you don’t care about the detailed disk/raid configuration, you can select “Summary” instead of “Detailed” for each bucket type. This allows you select a price per GB to calculate the monthly costs. I hope that answers your question.

Robert Fujara
February 20, 2015

One Trackback

  1. […] Team Blog: here the Splunk teams are constantly writing blog posts about interesting stuff; […]