At a high level, the type and size of the Splunk solution you build will depend mostly on two factors:
- The volume of data you will be indexing each day
- The peak number of concurrent searches that will be running
The volume of data indexed will be the average daily total of all the inputs from your various data sources—server logs, network and security devices, and so on. The number of concurrent searches includes both ad hoc searches from users, and the number of scheduled saved searches that will be running periodically to populate reports, dashboards, and alerts. To determine these factors you will need to collect some data from your user communities and do some fairly straightforward calculations.
