-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Splunk 9.x Enterprise Certified Admin Guide
By :

Creating a custom index is a Splunk administrator’s responsibility. As you have seen, data is retained in indexes until it reaches a certain age or the index reaches a certain size, so an estimation of an index’s size before it is created is a crucial step. Having an accurate estimation retains the data for the necessary amount of time, and it also helps to determine the required storage capacity upfront.
In order to estimate the size of the index, we must have the answers to the following questions:
Answer: For example, 100 days
Answer: For example, 1 GB
The formula for index size estimation is as follows:
Retain days X volume per day X 1/2 (raw data compression + index files)
If we substitute in the example values, the index size becomes 100 X 1 X (½) = 50 GB.
Now that you know...