All Apps and Add-ons

How to estimate how much data will be indexed per user when using Google Apps for Splunk?


I know this is a broad question with an endless amount of answers, but we are trying to get an estimate of how much data is indexed when using the Google Apps for Splunk. We are mainly concerned with security data from this app, so logins, login attempts, user changes, data movement, etc.

Any high level estimates about how much data per user will be created so we can decide on what licensing we need?


We have part of the data collection working and are working with the developer to get the last 2 inputs working but from what I see at this point, the data indexed is pretty minimal in our environment of about 800 users. We are currently seeing less than a gb a day and don't expect it to go over 2gb once the other inputs are in.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...