System requirements and performance impact for Splunk Asset and Risk Intelligence

Note: Splunk Asset and Risk Intelligence is not compatible with Splunk Enterprise 9.1.2 due to known issues SPL-237796, SPL-248319 where search results in "results" have more rows than expected. Upgrade to Splunk Enterprise 9.1.3 to use Splunk Asset and Risk Intelligence.

Before installing Splunk Asset and Risk Intelligence, review the hardware requirements and performance impact. Also, see System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual to find the list of supported operating systems, browsers, and file systems.

Hardware requirements

Splunk Asset and Risk Intelligence requires the following minimum hardware specifications:

Machine role Minimum CPU Minimum RAM
Search head 24 cores 32 GB
Indexer 24 cores 32 GB

Performance impact

For the best performance, use 2 Splunk indexers with at least 800 IOPS and 150 GB disk space. Anything less than these requirements significantly impacts the performance of Splunk Asset and Risk Intelligence.