Getting Data In

What will be the size of the indexed data if I send 50GB of raw data to Splunk?

Motivator

I send daily 50 GB raw data from my machines to Splunk for indexing
what will be the size of the data after it got indexed ?

Will this be the same 50 Gb or indexed data will have less size ?

SplunkTrust
SplunkTrust

Hi splunker12er,

it all depends on your raw data, but basically you can say compression between 30-50% are normal, you can check this with this search:

 | dbinspect index=YOURINDEX
 | fields state,id,rawSize,sizeOnDiskMB 
 | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB
 | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
 | eval compression=tostring(round(diskTotalinMB / rawTotalinMB * 100, 2)) + "%"
 | table rawTotalinMB, diskTotalinMB, compression

cheers,

MuS

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!