Hi Splunkers, I have to calculate daily ingested volume in a Splunk Enteprise environment.
Here on community I found a lot of post, and related answer, to a similar question: daily license consumption, but I don't know if it is what I need.
I mean: we know that, once data are ingested by Splunk, compression factor is applied and, in a non clustered environment, it is more or less 50%. So, for example, if I have 100 GB data ingested by day, final size on disk will be 50 GB .
Well, I have to calculate total GB BEFORE compression is applied. So, in my above example, search/method I need should NOT return 50 GB as final result, but 100 GB.
Moreover, in my current env, I have an Indexers cluster.
So, what is not clear is: daily consumed License, is what I need?
I mean: when I see daily consumed license by my environment, GB returned are the ingested one BEFORE compression, or the Compressed one?
