Portable calculator

SCPcalc

Step-by-step wizard → storage, design, resources, indexes.conf.

Designed by Mohammad Mirasadollahi · GitHub · Documentation

Plan your Splunk capacity

Start with volume & retention, then cluster topology and sources — then Calculate.

Results

Architecture design

Nodes

Find in table

Each planning role is expanded into labeled nodes (e.g. Indexer → Peer). Select rows to see full specs below.

Select	Label	Node	Role	Tier	RAM	CPU physical	Disk/node

Selected node specs

Select one or more nodes above to show full hardware specs.

Label	Node	Role	Tier	CPU physical	CPU logical / vCPU	RAM	IOPS	RAID	Storage	Disk/node	Network	Virtualization	Splunk parallelization	Notes

Hardware by role

Find in table

Role	×	Tier	CPU physical	CPU logical / vCPU	RAM	IOPS	RAID	Storage	Disk/node	Network	Virtualization	Splunk parallelization	Notes

Recommended resources

Planning settings

Per-index sizing

Find in table

Index name	Source label	Avg event size	Daily raw volume	Daily on-disk	Searchable size	Total Index volume	Hot/warm (homePath)	Cold volume	Hot bucket size	Retention days	Summary index

Configuration wizard

Capacity plan

1Overview
2Volume
3Cluster
4Review

Overview

Walk through volume (budget, sources, policy, paths), cluster, then review. Nothing is locked — change any value later.

Volume — daily ingest, sources (with per-index retention), policy, and disk paths.
Cluster — indexer clustering, search-head clustering, premium apps, and SmartStore.
Review — summarize everything, then Calculate.

Optional: I can seed recommended defaults (retention, disk budgets, concurrent users/searches, demo sources, and cluster/SHC/SmartStore when volume warrants it) from the volume drivers on the Volume step. You can override anything afterward.

Volume

Daily volume & drivers

These values are the planning budget for later steps. Per-index volumes on the Sources tab must stay within the daily total; searchable disk need must stay within the hot/cold budgets on Policy.

Total daily ingest (GB/day)Raw/license volume before compression — not on-disk size. Cap for all enabled sources on the Sources tab Total daily EPSLinked to GB/day via average event size below

Avg event size (bytes)Average raw event / alert size — strongly drives GB↔EPS. Apply seeds sources; override per source later on the Sources tab Safety margine.g. 1.2 = keep 20% spare capacity — multiplies searchable disk caps

Leave GB/EPS blank only if you plan solely from per-source volumes on the Sources tab. Edit either side — the other updates from avg event size.

Enter volume as GB/day or EPS

Use the linked GB/day = EPS pair on each source (and on Total daily volume). Edit either side — the other updates from average event size. Planning math always uses raw Daily GB under the hood.

EPS = raw events arriving from the source (before Splunk compression). With average event size it becomes Daily raw GB; on-disk ≈ that × Comp.

Log sources

Turn on each source and set daily GB/EPS. Optional Retention / Hot-warm days override Policy globals (blank = use Policy). Index size (GB) is a live cluster-wide preview of maxTotalDataSizeMB ≈ on-disk × retention × headroom (under-fill scales to total_daily_gb; conf may ÷ peers). Need vs Policy disk budgets is checked live with a clear error.

Use	Source	Index name	Avg event (bytes)	GB/day = EPS	Retention days	Hot/warm days	maxTotal (MB) · EPS	Summary	Summary GB/day

These are Splunk volume path = values (filesystem mounts). Size caps are on Policy as maxVolumeDataSizeMB — not here.

Hot/warm volume path[volume:hotwarm] path — local SSD only Cold volume path[volume:cold] path Summaries volume path[volume:_splunk_summaries] path — SSD for tstats/DMA

Topology & apps

Indexer cluster

Enable clustering for the indexer tier — set RF/SF and optional peer count override.

Indexer cluster Number of indexersLeave 0 to calculate automatically

Search head cluster

Set concurrent users and searches — Splunk sizes Search Heads from users × daily volume, then raises SH count so total cores cover peak concurrent searches.

Search head cluster Concurrent search usersPeople searching at the same time (official SH×IDX table) Peak concurrent searchesScheduled + ad-hoc jobs at peak (1 search ≈ 1 CPU core) Saved / scheduled searchesTotal enabled saved searches (Dimensions sizing input) Number of search headsLeave 0 to calculate from users × volume × searches