Splunk provides an excellent guide to all the factors and considerations for hardware options selection in their capacity planning manual; this is a ~35-page document that you will want to read before making a final choice regarding hardware options: https://docs.splunk.com/Documentation/Splunk/latest/Capacity/IntroductiontocapacityplanningforSplunkEnterprise.
There are several takeaways from this document that warrant emphasizing:
- If you anticipate needing to scale your Splunk deployment to any extent, you will likely be building a distributed environment with an indexing cluster and a search head cluster.
- As discussed in previous sections, the primary factors affecting the performance of your Splunk solution ...
