Splunk Platform Sizing

Splunk Platform Sizing

Prerequisites

Workflow Overview

┌───────────┐   ┌───────────────┐   ┌───────────────┐   ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘   └───────────────┘   └───────────────┘   └─────────────────┘

When to Activate

• Size a Splunk cluster, decide how many indexers or search heads they need, plan reference hardware, evaluate an All-In-One vs distributed deployment, size Splunk on Kubernetes, or estimate storage for a retention requirement.
• Preview and review the splunk platform sizing workflow before any live apply phase.
• Diagnose failed prerequisites, generated assets, configuration, or validation evidence.

Scope

Follow the documented read-only or render-first path whenever it is available. This skill does not imply permission to mutate live systems. Require explicit apply flags, protected credentials, and operator review for state changes.

Examples

Inspect the supported setup modes before selecting one:

bash skills/splunk-platform-sizing/scripts/setup.sh --help

Expected output: usage, supported modes, and required arguments are displayed without changing the target environment.

Inspect validation modes before running completion checks:

bash skills/splunk-platform-sizing/scripts/validate.sh --help

Expected output: offline, live, and completion options are displayed when the skill supports them; help exits without mutation.

Troubleshooting

This skill turns a stated use case into a concrete Splunk sizing across four deployment families:

1. All-In-One (S1) single-server standalone.
2. Distributed Splunk Validated Architectures (C1 / C3 / M-series).
3. Splunk on Kubernetes - Splunk Operator (s1/c3/m4) and Splunk POD (pod-small/pod-medium/pod-large).
4. Splunk Cloud (ingest + workload guidance; Splunk-managed).

The skill is offline and advisory: it needs no Splunk connection and no credentials. It renders a Markdown report and a sizing.json to a gitignored directory. All numbers are planning estimates, not a substitute for a Splunk Professional Services sizing.

How To Use It

Collect the use case, then run the calculator. Ask only for non-secret planning values: daily ingest (GB/day), searchable retention (days), search load (concurrent searches or users), whether premium apps (Enterprise Security, ITSI) are in scope, and whether high availability is required.

Render a sizing (writes sizing-report.md + sizing.json):

bash skills/splunk-platform-sizing/scripts/setup.sh \
  --daily-ingest-gb 500 \
  --retention-days 90 \
  --workload-profile es \
  --concurrent-searches 24 \
  --ha

All-In-One check for a small, low-search shop:

bash skills/splunk-platform-sizing/scripts/setup.sh \
  --daily-ingest-gb 80 \
  --retention-days 30 \
  --deployment-target standalone

Size for Splunk on Kubernetes with SmartStore:

bash skills/splunk-platform-sizing/scripts/setup.sh \
  --daily-ingest-gb 1200 \
  --workload-profile es_itsi \
  --ha \
  --smartstore \
  --deployment-target sok

Print the JSON without writing files (good for piping):

bash skills/splunk-platform-sizing/scripts/setup.sh \
  --daily-ingest-gb 300 --deployment-target cloud --dry-run --json

Inputs

With --deployment-target auto (the default) the engine recommends standalone when the use case is All-In-One eligible, otherwise distributed. RF or SF greater than one automatically implies HA. SF greater than RF is rejected. Multisite SOK replica counts are rounded up per site so uneven totals are not under-provisioned.

What It Computes

• Indexer count from effective_ingest / per-indexer ceiling, where the ceiling depends on the workload profile and search density. Floored to the clustering minimum when HA is requested.
• Search head count from concurrent searches, promoting to a search head cluster when more than one is needed or HA is requested. Premium apps (Enterprise Security, ITSI) add dedicated search heads.
• Storage = ingest x compression (~50%) x retention x replication factor, split across indexers, with a SmartStore local-cache note when enabled.
• Reference hardware per role (vCPU / RAM / IOPS).
• All-In-One eligibility gate with explicit reasons when standalone is not viable.

It then maps the result onto each deployment target (SVA category, SOK architecture, POD profile, Cloud workload tier) and emits hand-offs.

Hand-off Contracts

The report ends with hand-offs to the skills that actually deploy what was sized:

• Standalone or distributed install -> splunk-enterprise-host-setup
• Indexer cluster -> splunk-indexer-cluster-setup
• Search head cluster -> splunk-search-head-cluster-setup
• Splunk on Kubernetes (SOK / POD) -> splunk-enterprise-kubernetes-setup
• Retention / SmartStore indexes.conf -> splunk-index-lifecycle-smartstore-setup
• Splunk Cloud indexes and stack -> splunk-cloud-acs-admin-setup

Out of Scope

• Live ingest discovery from the Monitoring Console (bring the GB/day figure).
• License sizing/quotas (use splunk-license-manager-setup).
• Forwarder fleet sizing (use splunk-deployment-server-setup / splunk-agent-management-setup).
• Exact Splunk Cloud SVC pricing; the Cloud output is workload guidance only.

References

• reference.md for the full sizing model, constants, SVA and reference-hardware tables, premium multipliers, and the SOK/POD/Cloud mapping rules.
• template.example for the non-secret intake worksheet.