Getting Data In

Best Practice for Gauging the Amount of Data Ingested Daily

itsmevic
Communicator

What is the best method for gauging the amount of data a log source feeds in? for example, let the system send data to the indexer(s) for a set period of time i.e. 24 hours ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's the method I use. Depending on the source, you may not need to leave it running for 24 hours as sometimes an hour or two is enough for an estimate.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!