Calculate total index size (without replication)

[kutzi]

Is there a way to calculate how the index size would be, if they wouldn't be replicated - i.e. how much disk size I would need per indexer if replication factor == number of indexers?

The values displayed in the Monitoring Console (e.g. Index Detail: Deployment) seem to show the sum of the index size across all indexers
Also https://community.splunk.com/t5/Archive/How-to-calculate-the-index-size-from-all-indexers/m-p/96940 goes into that direction, but I also can only see the summed size or the size per indexers.

[gcusello]

Hi @kutzi ,

if the replication factor is the number of indexes, this means that in each Indexer you have all the data.

So you can calculate the disk occupation.

You could also calculate it (for each index) in this way:

space=daily_indexed_average*0.5*days_of_retention

Ciao.

Giuseppe

[kutzi]

I have 3 indexers, but a replication factor of 2. I'd like to know how much space I'd need per indexer, if the replication factor would be 3.

[gcusello]

Hi @kutzi ,

the storage occupation is, for each clustered Indexer:

space=daily_indexed_average*0.5*days_of_retention*(RF*0.15+SF*0.35)/num_Indexers

It depends on the Replication Factor, but also on the Search Factor.

Then it depends on the Data Models, Summary indexes and Accelerations you have.

Ciao.

Giuseppe

[kutzi]

Thanks.

Do you know if there's a query to get the daily_indexed_average?

[gcusello]

HI @kutzi ,

see the License Consuption (last 30 days) dashboard [Settings -- Licensing -- Usage Report -- Previous 30 days].

If you like, you can take that search and modify it.

Ciao.

Giuseppe