Getting Data In

Are internal events compressed ??

hectorvp
Communicator

Are internal events compressed to 50% as it does for any normal events?

For avg raw size of events in metrics.log is 150bytes

So while storing it in indexer will it take approx 75 bytes??

1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @hectorvp,

all the indexes (internal and external) are compressed:

  • rawdata are around 15% of the raw pre-indexed data,
  • index files are around 35% of the raw pre-indexed data.

In total 50%.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @hectorvp,

all the indexes (internal and external) are compressed:

  • rawdata are around 15% of the raw pre-indexed data,
  • index files are around 35% of the raw pre-indexed data.

In total 50%.

Ciao.

Giuseppe

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...