KB 161 (Splunk): Splunk Role Sizing Guidelines
Version: 1 from 31.08.2022
Important Warning! Any modifications to the disk quota and concurrent search limits assigned to roles could have significant negative performance impacts to your Splunk environment. Any changes to these limits should be first reviewed by the Splunk team responsible for your Splunk environment, since they are the only individuals capable of assessing impact on performance.
If you wish to modify the default disk quota available to a user because searches are being queued after executing the dashboard, you can do so by following the steps below:
Click on “Settings” and on “Roles”
Click Edit → Edit for the role that you wish to modify
Click on Resources
Important Warning! Once again, please ensure that you consult with the individuals responsible for your Splunk platform before you adjust the role parameters. It can lead to significant performance degradation in your Splunk environment.
Modify the disk space limit parameter to the desired value (see table below):
Below are examples of what other PowerConnect customers place as their disk space limit based on the data ingest provided by their largest SAP system:
Largest SAP System - Splunk Ingest GB/day
Disk Space Limit for Standard Searches