Deployment Architecture

Calculate total index size (without replication)

kutzi
Path Finder

Is there a way to calculate how the index size would be, if they wouldn't be replicated - i.e. how much disk size I would need per indexer if replication factor == number of indexers?

The values displayed in the Monitoring Console (e.g. Index Detail: Deployment) seem to show the sum of the index size across all indexers
Also https://community.splunk.com/t5/Archive/How-to-calculate-the-index-size-from-all-indexers/m-p/96940 goes into that direction, but I also can only see the summed size or the size per indexers.

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kutzi ,

if the replication factor is the number of indexes, this means that in each Indexer you have all the data.

So you can calculate the disk occupation.

You could also calculate it (for each index) in this way:

space=daily_indexed_average*0.5*days_of_retention

Ciao.

Giuseppe

0 Karma

kutzi
Path Finder

I have 3 indexers, but a replication factor of 2. I'd like to know how much space I'd need per indexer, if the replication factor would be 3.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kutzi ,

the storage occupation is, for each clustered Indexer:

space=daily_indexed_average*0.5*days_of_retention*(RF*0.15+SF*0.35)/num_Indexers

It depends on the Replication Factor, but also on the Search Factor.

Then it depends on the Data Models, Summary indexes and Accelerations you have.

Ciao.

Giuseppe

kutzi
Path Finder

Thanks.

Do you know if there's a query to get the daily_indexed_average?

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @kutzi ,

see the License Consuption (last 30 days) dashboard [Settings -- Licensing -- Usage Report -- Previous 30 days].

If you like, you can take that search and modify it.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...