Long-term data retention recommendations


This topic provides hardware configuration recommendations if you want to retain data for a longer period as compared to the recommendations available for horizontal scaling and vertical scaling of the product.

These recommendations are aimed at providing a 90-day data retention period and are meant for reference purposes only.

These recommendations can be useful in the following scenarios:

  • If you want to retain data for a longer period in your system.
  • If you want to run tabular commands on a bigger set of data.
    For more information about tabular commands, see Search-commands.

Refer to the following configuration recommendations for achieving a 90-day data retention period:

Understanding the configuration recommendations

A higher data retention impacts the following resources:

  • CPU
  • RAM
  • Disk space
  • Maximum memory required for the Indexer

This topic covers recommendations for a multiple-server deployment with the Indexer component scaled-out. For more information, see the following links:

The recommended setups consider the following distribution of components:

  • One server hosting the Console Server, Search, Collection Station, and Configuration Database components.
  • Additional servers with one Indexer per server.
    The number of Indexers required can be determined by the size of your environment (medium or large setup). For more information, see Horizontal-scaling-recommendations.

As the number of servers hosting the Indexer component increases, the disk space, RAM, and maximum memory required for the Indexer component reduces proportionately.

Setup with one Indexer server

The following tables list the configurations recommendations for a setup with one Indexer.

1 server hosting 1 IndexerThe [confluence_table-plus] macro is a standalone macro and it cannot be used inline. Click on this message for details.

Setup with two Indexer servers

The following tables list the configurations recommendations for a setup with two Indexers.

2 servers hosting 1 Indexer each
The [confluence_table-plus] macro is a standalone macro and it cannot be used inline. Click on this message for details.

Setup with five Indexer servers

The following tables list the configurations recommendations for a setup with five Indexers.

5 server hosting 1 Indexer each
The [confluence_table-plus] macro is a standalone macro and it cannot be used inline. Click on this message for details.

Setup with all other components

The following tables list the configurations recommendations for a setup with one instance of the Console Server, Search, Collection Station, and Configuration Database components.

1 server hosting Console Server, Search, Collection Station, and Configuration DatabaseThe [confluence_table-plus] macro is a standalone macro and it cannot be used inline. Click on this message for details.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*