Deployment Architecture

How much Storage should I be considering?

jesusgalloEMC
Explorer

Hello community,

First of all thank you for taking the time to look at my question.
I will be ingesting the following syslog data and need to do some calculation with the compression ratio and I have the following data:

I need to daily ingest 250GB
Retention needed: 90 days

I calculated 250GB x 90 days or retention = 22.5TB of Storage

BUT! i wasnt considering Compression, after i checked my compression ratio is 50%

Then my question to you will be.
when speaking about 50% of compression ratio, then it means i will be only storing half of the ingested? meaning 125GB out of 250GB?

Meaning my required storage then will be 11.5TB for 90 days?

Please let me know if this is clear, and if i am doing the right approach.

Thank you very much in advance!

Tags (2)
0 Karma

HiroshiSatoh
Champion

That's right. There are also sites like this.
https://splunk-sizing.appspot.com/

You also need a disk to restore the archive area or archive. be careful.

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...