Deployment Architecture

How much Storage should I be considering?

jesusgalloEMC
Explorer

Hello community,

First of all thank you for taking the time to look at my question.
I will be ingesting the following syslog data and need to do some calculation with the compression ratio and I have the following data:

I need to daily ingest 250GB
Retention needed: 90 days

I calculated 250GB x 90 days or retention = 22.5TB of Storage

BUT! i wasnt considering Compression, after i checked my compression ratio is 50%

Then my question to you will be.
when speaking about 50% of compression ratio, then it means i will be only storing half of the ingested? meaning 125GB out of 250GB?

Meaning my required storage then will be 11.5TB for 90 days?

Please let me know if this is clear, and if i am doing the right approach.

Thank you very much in advance!

Tags (2)
0 Karma

HiroshiSatoh
Champion

That's right. There are also sites like this.
https://splunk-sizing.appspot.com/

You also need a disk to restore the archive area or archive. be careful.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...