Reporting

Does License Usage "Daily License Usage" report show the raw size or the size on disk?

stevepraz
Path Finder

In preparation for a new environment we want to Splunk, I'm trying to apply some proper retention policies for our existing data to free up additional space.

I was told for each indexer in order to estimate approximately 50% of the raw data size (because of the compression) per day times the amount of days to keep, divided by the number of indexers.

Is there a way to see the raw data daily size in Splunk for a particular index? In the licensing reports, there is a "Daily License Usage" that can be broken down by index and has a value in GB for any given index in a day. Is that value the raw value or the already compressed value?

0 Karma
1 Solution

aaronkorn
Splunk Employee
Splunk Employee

If you are on Splunk 6.1+ give this app a try as it has some views you might be looking for: https://apps.splunk.com/app/1919/. To your question though the report is looking at the raw size, not whats actually on disk. To get the size of a particular index on disk give the dbinspect command a try: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Dbinspect

View solution in original post

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

If you are on Splunk 6.1+ give this app a try as it has some views you might be looking for: https://apps.splunk.com/app/1919/. To your question though the report is looking at the raw size, not whats actually on disk. To get the size of a particular index on disk give the dbinspect command a try: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Dbinspect

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...