Does License Usage "Daily License Usage" report show the raw size or the size on disk?

[stevepraz]

In preparation for a new environment we want to Splunk, I'm trying to apply some proper retention policies for our existing data to free up additional space.

I was told for each indexer in order to estimate approximately 50% of the raw data size (because of the compression) per day times the amount of days to keep, divided by the number of indexers.

Is there a way to see the raw data daily size in Splunk for a particular index? In the licensing reports, there is a "Daily License Usage" that can be broken down by index and has a value in GB for any given index in a day. Is that value the raw value or the already compressed value?

[aaronkorn · Accepted solution]

If you are on Splunk 6.1+ give this app a try as it has some views you might be looking for: https://apps.splunk.com/app/1919/. To your question though the report is looking at the raw size, not whats actually on disk. To get the size of a particular index on disk give the dbinspect command a try: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Dbinspect