Splunk sizing calculator
A free Splunk sizing calculator and deployment worksheet. Enter ingest, retention, and architecture. It returns indexer count, tiered storage per node and across the cluster, a server bill of materials including premium apps, and a matching indexes.conf.
Planning estimate only. Output is a starting point for an architecture conversation, not a validated design. Real requirements shift with data mix, field cardinality, search concurrency, and compression. Validate against a pilot before you buy hardware. See the full disclaimer.
Start from a reference size
Daily ingest
Retention
Splunk’s published aggregate is 15% rawdata + 35% tsidx ≈ 50% of pre-indexed volume. Raise tsidx for highly structured, high-cardinality sources.
Architecture
Splunk’s performance table sizes search heads and indexers by users and daily volume. A deployment server needs its own host once it manages more than 50 clients, so the forwarder count decides whether one is added.
Splunk’s documentation says a deployment server with more than 50 clients should run on its own instance, because app downloads use a lot of CPU and memory. Sharing is common on small deployments with a small fleet, but it is outside that guidance. Sharing is honored up to 1,000 clients.
Premium apps licensed separately
Design point year 3
Deployment topology
Storage by tier
| Tier | Multiplier | Per indexer | All indexers |
|---|
Server bill of materials
| Role | Qty | Cores / vCPU | RAM | Storage each |
|---|
Design notes and constraints
indexes.conf per indexer · single volume set
Splunk sizing explained
Splunk sizing means estimating how many indexers and search heads a deployment needs, how much storage each one needs, and which supporting servers sit around them, starting from your daily ingest, retention and search load. This calculator applies Splunk's published sizing guidance to your numbers and labels every figure that is a planning assumption instead.
How much storage does Splunk need?
Splunk's rule of thumb is that rawdata compresses to about 15% of the original size and the index files (tsidx) add about 35%, so roughly half of the pre-indexed volume. In an indexer cluster the total is (replication factor x 15%) + (search factor x 35%) of the daily volume.
Example: 100 GB/day with a replication factor of 3, a search factor of 2 and 90 days of searchable retention is 100 x (0.45 + 0.70) = 115 GB per day, or about 10.4 TB before contingency. Enterprise Security data model acceleration and ITSI summaries add to that.
How many Splunk indexers do I need?
Splunk's capacity guidance lists up to about 300 GB/day per reference indexer that also serves a search load. Enterprise Security is sized at about 100 GB/day per indexer, and ITSI at one indexer per 100 GB indexed. Splunk's performance table also scales indexers and search heads by concurrent users and daily volume, which is why the calculator asks for both.
What hardware does a Splunk indexer need?
Splunk's reference indexer is 12 physical cores (24 vCPU) and 12 GB of RAM, on disks that sustain at least 800 IOPS. Enterprise Security raises the minimum for indexers and search heads to 16 cores (32 vCPU) and 32 GB of RAM. The calculator lists the result as a server bill of materials.
Splunk Enterprise or Splunk Cloud?
This calculator sizes Splunk Enterprise that you run yourself. With Splunk Cloud Platform, Splunk runs the indexers and search heads, so the planning question becomes what you build on your own network to collect data.
Splunk Cloud users can work out their collection tier, firewall rules and bandwidth with the Splunk Cloud ingest planner.
Frequently asked questions
How do I calculate Splunk storage requirements?
Start from daily ingest and multiply by retention. Splunk's rule of thumb stores rawdata at about 15% and index files at about 35% of the original volume. In a cluster the total is (replication factor x 15%) + (search factor x 35%) of daily volume, then add data model acceleration, premium app summaries and contingency. The calculator does this by tier: hot, warm, cold, frozen and SmartStore.
How many GB per day can one Splunk indexer handle?
Splunk's capacity guidance gives up to about 300 GB/day for a reference indexer that is also serving searches. With Enterprise Security the figure is about 100 GB/day per indexer, and ITSI is sized at one indexer per 100 GB indexed. Real capacity depends on search load, so the calculator lets you choose a workload profile and flags which numbers are Splunk's and which are assumptions.
How much extra storage does Splunk Enterprise Security need?
Splunk's guidance for data model acceleration is about 3.4 times the daily volume per year of summary range, on top of the indexed data. Splunk also says to work with Professional Services when you plan to ingest 1 TB/day or more into Enterprise Security. The calculator adds the acceleration storage and shows a note at that volume.
Do I need a separate Splunk deployment server?
Splunk says a deployment server with more than 50 clients should run on its own dedicated Splunk Enterprise instance. With 50 or fewer it can share an indexer or search head. The calculator follows that by default and offers an option to share it on small fleets, clearly marked as outside Splunk's guidance.
How many search heads do I need for a search head cluster?
A search head cluster needs at least three members to be highly available, and each search head cluster needs its own deployer. The calculator adds the right number of members and deployers for the search tiers you select.
Does the calculator generate an indexes.conf?
Yes. It writes an indexes.conf with volume sizes, retention and replication settings that match the sizing result, so you can compare it with your current configuration.
Is this Splunk sizing calculator free and private?
Yes. It is free to use and needs no sign-up. All calculations run in your browser, and nothing you enter is transmitted, logged or stored by the site.
How accurate is a Splunk sizing estimate?
It is a planning estimate, not a validated design. Actual needs vary with data mix, search concurrency, compression and platform version, so validate the result with a pilot before buying hardware.
Sources for the constants used above
- 15% rawdata + 35% tsidx ≈ 50% of pre-indexed volume. Estimate your storage requirements. Clustered storage = (RF × rawdata) + (SF × tsidx). Disk space estimator for index replication.
- 300 GB/day per reference indexer under a search load (the Light profile), and Splunk’s table of search heads and indexers by users and daily volume up to 3 TB/day. Summary of performance recommendations. Reference hosts, 800 sustained IOPS, 300 GB search head storage, the 10 to 15 percent VM indexing penalty, and latency limits of 100 ms for indexer clusters and 200 ms for search head clusters: Reference hardware.
- ES: about 100 GB/day per indexer (300 GB on 3 indexers, 1 TB on 10, 15 TB on 150), a Professional Services engagement at 1 TB/day or more, and a field architect above 15 TB/day: Performance reference for Splunk Enterprise Security and Considerations for scaling deployments. Minimum search head and indexer: 16 cores, 32 GB, 32 vCPU: Minimum specifications.
- Data model acceleration = daily volume × 3.4 per year. 100 GB/day needs roughly 340 GB extra across the indexers. Configure data models for Splunk Enterprise Security. Splunk Lantern adds “or more if replicated in an indexer cluster”: Managing data models in Enterprise Security. Multiplying by the search factor is a planner assumption.
- ITSI: 1 indexer per 100 GB indexed; roughly one added indexer and search head per 500 KPIs, or one search head per 333 KPIs at 50 entities per KPI; 30 GB free in $SPLUNK_HOME for the KV store; real-time searches cannot be disabled. Plan your ITSI deployment.
- SOAR on-premises: 1 server-class CPU (4–8 cores), 16 GB RAM minimum / 32 GB recommended, and three 500 GiB volumes (home, data, vault). System requirements for production use. A cluster needs at least three nodes: About SOAR clusters.
- ES Premier extends Essentials with native SOAR and UEBA. Overview of ES editions. UEBA is available by default in Premier, and the UEBA Content App installs on the ES search head: UEBA Content App. On-premises Premier needs ES 8.3 or later and SOAR 7.1.0 or later: Compatibility.
- Deployment server: a dedicated Splunk Enterprise instance above 50 clients, and the license manager, monitoring console or deployer may share it only at 50 or fewer: Plan a deployment, Which instance should host the console. Up to 25,000 clients per server in a cluster of up to three: Implement a deployment server cluster. The planner assumes 10,000 per server. App downloads use high CPU and memory, which is why Splunk recommends a dedicated host: Estimate deployment server performance. A longer phone home interval relieves a busy deployment server: Troubleshoot performance issues.
- A deployer can service only a single search head cluster, so each cluster needs its own, and 3 members are the minimum for high availability. System requirements for search head clusters.
- In a cluster each peer archives its own frozen copy, so RF 3 gives three archived copies. Archive indexed data.
- tsidx reduction cuts bucket size by about one-third to two-thirds, does not work with tstats, indexed real-time searches or SmartStore, and does not touch data model accelerations. Reduce tsidx disk usage.
- SmartStore: local cache for about 30 days of indexed data (at least 7 to 10 days): SmartStore system requirements. The monitoring console must run on a dedicated search head.
- Single instance (S1) suits under about 500 GB/day with no high availability and few users. Single Server Deployment (S1). The worksheet cuts over earlier. site0 disables search affinity: Implement search affinity.
- Planner assumptions, not Splunk figures: the Moderate (200) and Heavy (150) profiles, 75 GB/day per indexer for ES with ITSI, the ES search head RAM step above 60 detections, 15% contingency, heavy forwarder and management RAM, the SOAR external services, the SmartStore object store size (one copy of rawdata and tsidx over the full retention), the ITSI summary-index estimate (KPIs × entities × intervals per day × about 400 bytes), and the data model acceleration multiplier in clusters, and the 1,000 client ceiling for sharing a deployment server with another role (Splunk publishes no limit for a shared host).
Disclaimer and terms of use
Estimates only. This worksheet applies publicly documented Splunk sizing formulas to the values you enter. It produces planning estimates, not a validated architecture, a bill of sale, or a commitment of any kind. It has not been reviewed or certified by Splunk or Cisco.
Your inputs drive the output. Results are only as accurate as the assumptions entered. Actual indexer counts, storage consumption, and hardware requirements vary materially with data mix, event structure, field cardinality, compression, search concurrency, correlation and acceleration load, retention policy, and platform version. Splunk’s own guidance directs customers to Professional Services for architecture validation above 1 TB/day with Enterprise Security.
No warranty. This tool is provided “as is,” without warranty of any kind, express or implied, including any warranty of accuracy, merchantability, or fitness for a particular purpose. August Schell accepts no liability for any loss, cost, procurement decision, or damage — direct, indirect, incidental, or consequential — arising from use of or reliance on these results. Verify all figures against a pilot deployment and a formal architecture review before making purchasing or design commitments.
Trademarks. Splunk, Splunk Enterprise, Splunk Enterprise Security, Splunk SOAR, and Splunk IT Service Intelligence are trademarks of Splunk LLC, a Cisco company. August Schell is an independent systems integrator. This tool is not affiliated with, authored by, endorsed by, or sponsored by Splunk or Cisco.
Your data stays in your browser. All calculations run locally in this page. Nothing you enter is transmitted, logged, or stored by August Schell.
Sizing a real deployment? These numbers open the conversation — they don’t close it. August Schell architects Splunk environments for federal customers, including clustered indexer tiers, premium app deployments, and ingest pipeline design.