Deployment Architecture

How much Storage should I be considering?

jesusgalloEMC
Explorer

Hello community,

First of all thank you for taking the time to look at my question.
I will be ingesting the following syslog data and need to do some calculation with the compression ratio and I have the following data:

I need to daily ingest 250GB
Retention needed: 90 days

I calculated 250GB x 90 days or retention = 22.5TB of Storage

BUT! i wasnt considering Compression, after i checked my compression ratio is 50%

Then my question to you will be.
when speaking about 50% of compression ratio, then it means i will be only storing half of the ingested? meaning 125GB out of 250GB?

Meaning my required storage then will be 11.5TB for 90 days?

Please let me know if this is clear, and if i am doing the right approach.

Thank you very much in advance!

Tags (2)
0 Karma

HiroshiSatoh
Champion

That's right. There are also sites like this.
https://splunk-sizing.appspot.com/

You also need a disk to restore the archive area or archive. be careful.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...