What will be the size of the indexed data if I send 50GB of raw data to Splunk?

[splunker12er]

I send daily 50 GB raw data from my machines to Splunk for indexing
what will be the size of the data after it got indexed ?

Will this be the same 50 Gb or indexed data will have less size ?

[MuS]

Hi splunker12er,

it all depends on your raw data, but basically you can say compression between 30-50% are normal, you can check this with this search:

 | dbinspect index=YOURINDEX
 | fields state,id,rawSize,sizeOnDiskMB 
 | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB
 | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
 | eval compression=tostring(round(diskTotalinMB / rawTotalinMB * 100, 2)) + "%"
 | table rawTotalinMB, diskTotalinMB, compression

cheers,

MuS