Index holding data

[bharathkumarnec]

Hi Team,

We wanted to keep one year data in splunk for few of the indexes in our environment, we understand that we can make it in splunk but we need to have additional storage capacity available to achieve this requirement.

What is the best approach to store the data as per our requirement & the data that we store for one year should be fetched at any point in time.

Kindly help me out with best possible option.

TIA

Regards,
BK

[woodcock · Accepted solution]

Keep it in warm and make sure that you have enough disk space allotted to contain it (with fudge factor). There is a tool referenced here than can help:

https://www.splunk.com/blog/2015/02/18/splunk-sizing-made-easy.html

The best option, though, is roll up aggregate summary details regarding your raw events (perhaps daily totals/averages) and save this to a Summary Index which will vastly reduce the amount of storage required:

https://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Usesummaryindexing