How to calculate compression by sourcetype?

the_wolverine · ‎11-11-2013

I know how to use dbinspect to calculate compression by index. Is there a way to calculate compression by sourcetype for an index with mixed sourcetypes?

_d_ · ‎11-11-2013

Next to impossible. We don't keep track of different sourcetypes' rawdata and their corresponding size of the tsidx files.

How to calculate compression by sourcetype?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Conversation

How to calculate compression by sourcetype?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station