Splunk estimates an average of 50% compression:
read here in detail:
also the link above provided by @lfdedak is good
you can always check for yourself:
bring the data to splunk and then search the following:
| dbinspect index=* | fields state,id,rawSize,sizeOnDiskMB,index | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB by index | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal | eval compression=tostring(round(100 - diskTotalinMB / rawTotalinMB * 100, 2)) + "%"
will suggest to ignore indexes with very little data as this takes into calculation metadata files within the index and therefore you might see a huge negative compression on these tiny indexes.
hope it helps