I am trying to estimate how much indexing I would need from my setup for Splunk and was wondering exactly how indexing is calculated. I know from documentation that there are 2 types of files: compressed data and index files. For Splunk Free, would both the compressed data and index files count towards the 500MB/day or would it just be the index files?
If you are using the free version of Splunk you can only index 500mb per day. The 500MB per day consists of raw data defined within your inputs.conf files on your indexers and forwarders and excludes Splunk internal logs.
To estimate how much data you will be indexing look at how large the log files are and multiply by number of logs. Do that for each set of logs for a rough estimate.