Installation

Estimating storage requirements on a windows server

Scott
Engager

In the installation manual it shows how once you have indexed some data by using the "du -shc hot_v*/rawdata" command you are able to determine how large the compressed persisted raw data is. What is the equivalent command on a windows server?

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

Windows does not come with a command line tool for this. However, you can either simply select the relevant directories in Windows Explorer, right-click, and choose "Properties", or you can download and use the SysInternals du tool from: http://technet.microsoft.com/en-us/sysinternals/bb896651.aspx and run

for /d %i in (hot_v*) do du.exe -q "%i\rawdata"
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...