Deployment Architecture

Calculate total index size (without replication)

kutzi
Path Finder

Is there a way to calculate how the index size would be, if they wouldn't be replicated - i.e. how much disk size I would need per indexer if replication factor == number of indexers?

The values displayed in the Monitoring Console (e.g. Index Detail: Deployment) seem to show the sum of the index size across all indexers
Also https://community.splunk.com/t5/Archive/How-to-calculate-the-index-size-from-all-indexers/m-p/96940 goes into that direction, but I also can only see the summed size or the size per indexers.

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kutzi ,

if the replication factor is the number of indexes, this means that in each Indexer you have all the data.

So you can calculate the disk occupation.

You could also calculate it (for each index) in this way:

space=daily_indexed_average*0.5*days_of_retention

Ciao.

Giuseppe

0 Karma

kutzi
Path Finder

I have 3 indexers, but a replication factor of 2. I'd like to know how much space I'd need per indexer, if the replication factor would be 3.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kutzi ,

the storage occupation is, for each clustered Indexer:

space=daily_indexed_average*0.5*days_of_retention*(RF*0.15+SF*0.35)/num_Indexers

It depends on the Replication Factor, but also on the Search Factor.

Then it depends on the Data Models, Summary indexes and Accelerations you have.

Ciao.

Giuseppe

kutzi
Path Finder

Thanks.

Do you know if there's a query to get the daily_indexed_average?

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @kutzi ,

see the License Consuption (last 30 days) dashboard [Settings -- Licensing -- Usage Report -- Previous 30 days].

If you like, you can take that search and modify it.

Ciao.

Giuseppe

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!