splunk storage growth

[dfosullivan]

What is the anticipated storage needs / growth after Splunk is implemented? Is there a formula based upon number of hosts / devices?

[adamw]

FYI max index size is set to 500GB by default, burned us when we found out our older data was getting deleted since it was over that default value.

[sdaniels]

If you have Splunk in place you can use this to help you estimate storage requirements.

http://docs.splunk.com/Documentation/Splunk/latest/Installation/Estimateyourstoragerequirements

Generally speaking, based on the amount of data coming into splunk (per day) you can estimate the need for about 50% of that amount. Then you'll need to take into account your retention requirements. So daily average volume of data x retention policy in days x 50%. If you are using summary indexing in a large environment you'll most likely want to use 60%.

If you have a larger environment > 2 GB per day then look here:

http://docs.splunk.com/Documentation/Splunk/latest/Installation/CapacityplanningforalargerSplunkdepl...