index storage config

dall — Wed, 23 Dec 2020 11:33:15 GMT

We have a stand alone environment in which daily 100 GB data will be ingested, just want to know what would be the best index storage configuration in indexes.conf.

i have no. of indexes

i want to configure like this

[active-directory]

homePath= $SPLUNK_DB/active_directory/db

coldPath= $SPLUNK_DB/active_directory/colddb

thawedPath= $SPLUNK_DB/active_directory/thaweddb

maxHotBuckets=3

maxDataSize=300

maxWarmDBCount=300

maxTotalDataSizeMB=200000

frozenTimePeriodInSecs=172800

coldToFrozenDir= $SPLUNK_DB/ active_directory /frozendb

Can someone will help with suitable configuration, and what would be the disk space required to storage

if i ll config foe all indexes , ll i face any disk space issue??

Re: index storage config

gcusello — Wed, 23 Dec 2020 11:49:54 GMT

HI @dall,

only one information: do you really want to setup a retention of only two days?

Anyway, storage requiremnt is the following:

V = average of daily indexed logs (you can use also your license value);
C = compression factor: 0.5
R = retention (in days);
N = number of Indexers (1).

So your storage requiement is:

S = V * C * R / N = 100 * 0.5 * 2 / 1 = 100GB

Ciao.

Giuseppe

topic Re: index storage config in Splunk Search

index storage config

Re: index storage config