Reporting

Does License Usage "Daily License Usage" report show the raw size or the size on disk?

Path Finder

In preparation for a new environment we want to Splunk, I'm trying to apply some proper retention policies for our existing data to free up additional space.

I was told for each indexer in order to estimate approximately 50% of the raw data size (because of the compression) per day times the amount of days to keep, divided by the number of indexers.

Is there a way to see the raw data daily size in Splunk for a particular index? In the licensing reports, there is a "Daily License Usage" that can be broken down by index and has a value in GB for any given index in a day. Is that value the raw value or the already compressed value?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

If you are on Splunk 6.1+ give this app a try as it has some views you might be looking for: https://apps.splunk.com/app/1919/. To your question though the report is looking at the raw size, not whats actually on disk. To get the size of a particular index on disk give the dbinspect command a try: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Dbinspect

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

If you are on Splunk 6.1+ give this app a try as it has some views you might be looking for: https://apps.splunk.com/app/1919/. To your question though the report is looking at the raw size, not whats actually on disk. To get the size of a particular index on disk give the dbinspect command a try: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Dbinspect

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!