A generic answer isn’t especially possible – you could roll this out with a small team in a couple months…if all the hardware is in place, you’ve properly PoC’d, etc
Or it could take years for 20+ people, when you’re waiting on hardware, have network issues, have to manually ingest all your data, etc etc
February 05, 2020 at 07:59AM
via reddit https://www.reddit.com/r/Splunk/comments/ez8wao/how_many_ppl_does_one_need_for_a_huge_and_complex/fglpsbz?utm_source=ifttt