In preparation for a new environment we want to Splunk, I'm trying to apply some proper retention policies for our existing data to free up additional space.
I was told for each indexer in order to estimate approximately 50% of the raw data size (because of the compression) per day times the amount of days to keep, divided by the number of indexers.
Is there a way to see the raw data daily size in Splunk for a particular index? In the licensing reports, there is a "Daily License Usage" that can be broken down by index and has a value in GB for any given index in a day. Is that value the raw value or the already compressed value?