topic Re: Splunk not compressed my 500G of data. Why? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Splunk-not-compressed-my-500G-of-data-Why/m-p/105693#M97570 <P>Do you have multiple data sources feeding into the indexer? Also have you setup any index time field extractions?</P> <P>If you are just forwarding data across with no additional stuffs then there must be additional data being added at some point or excessive index time extractions. Roughly you get 50% compression ratio with Splunk (entirely dependent on your data though), Splunk will also create metadata files associated with your indexes that have metafields to speed indexing as well as bloom filters and other files. </P> Mon, 23 Jul 2012 10:59:21 GMT Drainy 2012-07-23T10:59:21Z Splunk not compressed my 500G of data. Why? https://community.splunk.com/t5/Getting-Data-In/Splunk-not-compressed-my-500G-of-data-Why/m-p/105692#M97569 <P>Hey Gurus,</P> <P>I have a situation where my data that's been stored in my indexers are bigger than the original data. What happened? How could this possible? We did't touch much config where all ciritical conf should be initial config.</P> <P>Anybody have any ideas?</P> <P>Thanks!</P> Mon, 23 Jul 2012 10:55:25 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-not-compressed-my-500G-of-data-Why/m-p/105692#M97569 clyde772 2012-07-23T10:55:25Z Re: Splunk not compressed my 500G of data. Why? https://community.splunk.com/t5/Getting-Data-In/Splunk-not-compressed-my-500G-of-data-Why/m-p/105693#M97570 <P>Do you have multiple data sources feeding into the indexer? Also have you setup any index time field extractions?</P> <P>If you are just forwarding data across with no additional stuffs then there must be additional data being added at some point or excessive index time extractions. Roughly you get 50% compression ratio with Splunk (entirely dependent on your data though), Splunk will also create metadata files associated with your indexes that have metafields to speed indexing as well as bloom filters and other files. </P> Mon, 23 Jul 2012 10:59:21 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-not-compressed-my-500G-of-data-Why/m-p/105693#M97570 Drainy 2012-07-23T10:59:21Z