If you are just getting started with Humio, we recommend running Humio as a Docker container since it contains the external dependencies needed, i.e. Kafka and Zookeeper. If you plan on running Humio on bare metal please refer to our Bare Metal Installation Guide.
Humio was made to scale and scales very well with the number of nodes in the cluster. Running a cluster of 3 or more humio nodes provides higher capacity in terms of both ingest and search performance and also allows high availability by replicating data to more than one node. If you want to run a clustered mode please refer to cluster setup.
Hardware requirements depend on how Humio will be used, both how much data you will be ingesting and how many concurrent searches you will be running.
Here is a list of rules of thumb to help you get an idea of how much hardware is needed.
Your machine has 64G of ram, 8 hyper threads (4 cores) and 1TB of storage. Your machine can hold 460GB of ingest data compressed in ram and process 8GB/s. In this case it means 10 seconds worth of query time will run through 80GB of data. So this machine fits an 80GB/day ingest, with +5 days data available for fast querying.
You can store 7.2TB of data before your disk is 80% full, corresponding to 90 days at 80GB/day ingest
This example assumes all data has the same Retention settings But you can configure Humio to automatically delete some events before others, e.g. allowing some data to be kept for several years while others get deleted after 1 week.
For more details refer to our Instance Sizing Reference.
Please refer to the configuration reference page.