Deployment Architecture

How much Storage should I be considering?

jesusgalloEMC
Explorer

Hello community,

First of all thank you for taking the time to look at my question.
I will be ingesting the following syslog data and need to do some calculation with the compression ratio and I have the following data:

I need to daily ingest 250GB
Retention needed: 90 days

I calculated 250GB x 90 days or retention = 22.5TB of Storage

BUT! i wasnt considering Compression, after i checked my compression ratio is 50%

Then my question to you will be.
when speaking about 50% of compression ratio, then it means i will be only storing half of the ingested? meaning 125GB out of 250GB?

Meaning my required storage then will be 11.5TB for 90 days?

Please let me know if this is clear, and if i am doing the right approach.

Thank you very much in advance!

Tags (2)
0 Karma

HiroshiSatoh
Champion

That's right. There are also sites like this.
https://splunk-sizing.appspot.com/

You also need a disk to restore the archive area or archive. be careful.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...