How is my indexed data stored/compressed on disk?

[mctester]

We created a new index called "foo"; its size is about 6.6GB on disk. Our main index "main" is 66GB.

Our daily indexing volume stat went from about 1.7GB (before adding index ens) to > 19GB. How is that possible? Should not that stats have gone up about 10%?

[Mick · Accepted solution]

The rawdata within the index is compressed, so we try to make the actual disk footprint as small as possible. If you want to take a copy of one of the files in $SPLUNK_DB/foo/db//rawdata and uncompress it to assess the compression ratio, go right ahead.