Does anyone have a feel for the default daily volume of logging data that would be generated and available to be indexed in Splunk App for a Citrix XenDesktop (v5.5 / v5.6) implementation using Splunk v4.3 (across approx 2,000 Citrix users)?
BACKGROUND INFO:
We would like to get a feel for the Splunk licensing given approx. 2,000 users in a Telco currently access their Siebel (CRM) application via Citrix and we are positioning Splunk + the Citrix XenApp for monitoring end user interactions and performance which is a solution requirement to monitor and ensure adequate end-user response times.
In the current release you can expect ~20-30mb per desktop per day but in the new release slated for Synergy (Barcelona) we expect a significant reduction with a goal of 5mb per desktop.