Getting Data In

hot/warm buckets


hi all,

I have seperate drive for my hot/warm and cold data.
The hot/warm drive is near capacity.

Looking to find an easy way to calculate how much data each index will hold.
One example index config set is as below

10955Mb ingest per day (10.9Gb)
MazDataSize = 750mb (max size in MB for a hot bucket to reach before it rolls to warm)
maxWarmDBCount = 436 (max number of warm buckets)
maxtotalDataSize = 4328249mb (4328Gb) (maximum size of the index (in Mb)
frozenTimePeriodinSecs = 34128000 (395days in seconds)(number of seconds after which indexed data rolls to frozen)
overall retention = 395 (13months)
overall warm in days = 30

I would like to know how i can work out what size this indexed data should take up on my hot/warm and cold drives.
The split of the 4328Gb between the hot/warm & cold drives over 13months.
Does anyone know how best to calculate this ?


0 Karma



Have you looked at, it will be a good starting point.

Splunk Employee
Splunk Employee

I was just about to share the same thing. This is a great tool for this task. You can play around with different retention times for hot/warm, cold, and archived (frozen).

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!