Monitoring Splunk

How is my indexed data stored/compressed on disk?

Communicator

We created a new index called "foo"; its size is about 6.6GB on disk. Our main index "main" is 66GB.

Our daily indexing volume stat went from about 1.7GB (before adding index ens) to > 19GB. How is that possible? Should not that stats have gone up about 10%?

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

The rawdata within the index is compressed, so we try to make the actual disk footprint as small as possible. If you want to take a copy of one of the files in $SPLUNK_DB/foo/db//rawdata and uncompress it to assess the compression ratio, go right ahead.

View solution in original post

Splunk Employee
Splunk Employee

The rawdata within the index is compressed, so we try to make the actual disk footprint as small as possible. If you want to take a copy of one of the files in $SPLUNK_DB/foo/db//rawdata and uncompress it to assess the compression ratio, go right ahead.

View solution in original post