topic Re: Calculate total index size (without replication) in Deployment Architecture

Calculate total index size (without replication)

kutzi — Thu, 02 Jul 2020 08:39:16 GMT

Is there a way to calculate how the index size would be, if they wouldn't be replicated - i.e. how much disk size I would need per indexer if replication factor == number of indexers?

The values displayed in the Monitoring Console (e.g. Index Detail: Deployment) seem to show the sum of the index size across all indexers
Also https://community.splunk.com/t5/Archive/How-to-calculate-the-index-size-from-all-indexers/m-p/96940 goes into that direction, but I also can only see the summed size or the size per indexers.

Re: Calculate total index size (without replication)

gcusello — Thu, 02 Jul 2020 08:49:31 GMT

Hi @kutzi ,

if the replication factor is the number of indexes, this means that in each Indexer you have all the data.

So you can calculate the disk occupation.

You could also calculate it (for each index) in this way:

space=daily_indexed_average*0.5*days_of_retention

Ciao.

Giuseppe

Re: Calculate total index size (without replication)

kutzi — Thu, 02 Jul 2020 08:53:26 GMT

I have 3 indexers, but a replication factor of 2. I'd like to know how much space I'd need per indexer, if the replication factor would be 3.

Re: Calculate total index size (without replication)

gcusello — Thu, 02 Jul 2020 09:06:08 GMT

Hi @kutzi ,

the storage occupation is, for each clustered Indexer:

space=daily_indexed_average*0.5*days_of_retention*(RF*0.15+SF*0.35)/num_Indexers

It depends on the Replication Factor, but also on the Search Factor.

Then it depends on the Data Models, Summary indexes and Accelerations you have.

Ciao.

Giuseppe

Re: Calculate total index size (without replication)

kutzi — Thu, 02 Jul 2020 09:24:34 GMT

Thanks.

Do you know if there's a query to get the daily_indexed_average?

Re: Calculate total index size (without replication)

gcusello — Thu, 02 Jul 2020 09:52:06 GMT

HI @kutzi ,

see the License Consuption (last 30 days) dashboard [Settings -- Licensing -- Usage Report -- Previous 30 days].

If you like, you can take that search and modify it.

Ciao.

Giuseppe