How to estimate how much data will be indexed per user when using Google Apps for Splunk?

[hlarimer]

I know this is a broad question with an endless amount of answers, but we are trying to get an estimate of how much data is indexed when using the Google Apps for Splunk. We are mainly concerned with security data from this app, so logins, login attempts, user changes, data movement, etc.

Any high level estimates about how much data per user will be created so we can decide on what licensing we need?

[hlarimer]

We have part of the data collection working and are working with the developer to get the last 2 inputs working but from what I see at this point, the data indexed is pretty minimal in our environment of about 800 users. We are currently seeing less than a gb a day and don't expect it to go over 2gb once the other inputs are in.