https://community.splunk.com/t5/Getting-Data-In/Best-Practice-for-Gauging-the-Amount-of-Data-Ingested-Daily/m-p/477276#M81934 <P>What is the best method for gauging the amount of data a log source feeds in? for example, let the system send data to the indexer(s) for a set period of time i.e. 24 hours ?</P> Thu, 09 Jan 2020 15:42:45 GMT itsmevic 2020-01-09T15:42:45Z https://community.splunk.com/t5/Getting-Data-In/Best-Practice-for-Gauging-the-Amount-of-Data-Ingested-Daily/m-p/477276#M81934 <P>What is the best method for gauging the amount of data a log source feeds in? for example, let the system send data to the indexer(s) for a set period of time i.e. 24 hours ?</P> Thu, 09 Jan 2020 15:42:45 GMT https://community.splunk.com/t5/Getting-Data-In/Best-Practice-for-Gauging-the-Amount-of-Data-Ingested-Daily/m-p/477276#M81934 itsmevic 2020-01-09T15:42:45Z https://community.splunk.com/t5/Getting-Data-In/Best-Practice-for-Gauging-the-Amount-of-Data-Ingested-Daily/m-p/477277#M81935 <P>That's the method I use. Depending on the source, you may not need to leave it running for 24 hours as sometimes an hour or two is enough for an estimate.</P> Thu, 09 Jan 2020 16:14:42 GMT https://community.splunk.com/t5/Getting-Data-In/Best-Practice-for-Gauging-the-Amount-of-Data-Ingested-Daily/m-p/477277#M81935 richgalloway 2020-01-09T16:14:42Z