https://community.splunk.com/t5/Reporting/How-do-I-get-a-complete-size-of-all-logs-ingested-by-Splunk/m-p/549943#M9047 <P>The first Best Practice is to only ingest what you need.&nbsp; Disable inputs for use cases you're not monitoring.&nbsp; Increase the input interval where possible.&nbsp; Be picky about which Windows events you ingest.</P><P>Trim the fat from Windows events.&nbsp; They all contain the same boiler-plate text at the end that serves no useful purpose.&nbsp; See&nbsp;<A href="https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorWindowseventlogdata#Suppress_fields_from_Windows_Event_Log_events" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorWindowseventlogdata#Suppress_fields_from_Windows_Event_Log_events</A>&nbsp;and&nbsp;<A href="https://community.splunk.com/t5/Getting-Data-In/Windows-Event-filtering-truncation-at-IDX-and-HF/m-p/442933" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Windows-Event-filtering-truncation-at-IDX-and-HF/m-p/442933</A></P> Fri, 30 Apr 2021 00:29:53 GMT richgalloway 2021-04-30T00:29:53Z https://community.splunk.com/t5/Reporting/How-do-I-get-a-complete-size-of-all-logs-ingested-by-Splunk/m-p/549845#M9032 <P>How do I get a complete size of all logs ingested by Splunk Enterprise &amp; Enterprise Security incl. Indexes. Showing indexes taking the most load?</P> Thu, 29 Apr 2021 14:01:27 GMT https://community.splunk.com/t5/Reporting/How-do-I-get-a-complete-size-of-all-logs-ingested-by-Splunk/m-p/549845#M9032 SamHTexas 2021-04-29T14:01:27Z https://community.splunk.com/t5/Reporting/How-do-I-get-a-complete-size-of-all-logs-ingested-by-Splunk/m-p/549892#M9040 <P>The Monitoring Console can show which indexes are getting the most data.&nbsp; It will even break it out by source, sourcetype, and (IIRC) host.</P> Thu, 29 Apr 2021 19:38:22 GMT https://community.splunk.com/t5/Reporting/How-do-I-get-a-complete-size-of-all-logs-ingested-by-Splunk/m-p/549892#M9040 richgalloway 2021-04-29T19:38:22Z https://community.splunk.com/t5/Reporting/How-do-I-get-a-complete-size-of-all-logs-ingested-by-Splunk/m-p/549898#M9041 <P>Thank u again Rich. Does the sizes show are the complete ( including all logs) for the Indexes. Are there any other place I need to check to come up with complete metrics? I am doing this for sake of saving licenses going over the limit. Would you by any chance have " best practices" for trimming the license fat ? Thank u sir.</P> Thu, 29 Apr 2021 19:45:36 GMT https://community.splunk.com/t5/Reporting/How-do-I-get-a-complete-size-of-all-logs-ingested-by-Splunk/m-p/549898#M9041 SamHTexas 2021-04-29T19:45:36Z https://community.splunk.com/t5/Reporting/How-do-I-get-a-complete-size-of-all-logs-ingested-by-Splunk/m-p/549943#M9047 <P>The first Best Practice is to only ingest what you need.&nbsp; Disable inputs for use cases you're not monitoring.&nbsp; Increase the input interval where possible.&nbsp; Be picky about which Windows events you ingest.</P><P>Trim the fat from Windows events.&nbsp; They all contain the same boiler-plate text at the end that serves no useful purpose.&nbsp; See&nbsp;<A href="https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorWindowseventlogdata#Suppress_fields_from_Windows_Event_Log_events" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorWindowseventlogdata#Suppress_fields_from_Windows_Event_Log_events</A>&nbsp;and&nbsp;<A href="https://community.splunk.com/t5/Getting-Data-In/Windows-Event-filtering-truncation-at-IDX-and-HF/m-p/442933" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Windows-Event-filtering-truncation-at-IDX-and-HF/m-p/442933</A></P> Fri, 30 Apr 2021 00:29:53 GMT https://community.splunk.com/t5/Reporting/How-do-I-get-a-complete-size-of-all-logs-ingested-by-Splunk/m-p/549943#M9047 richgalloway 2021-04-30T00:29:53Z