Splunk Enterprise

Does any champ here has an estimate of size of data ingest into Splunk for an average server on Daily basis? Thx a mill.

SamHTexas
Builder

Am preparing a report & need to estimate amount of data from an average say Microsoft or Linux (RHEL) server into Splunk on daily basis please. Just a rough estimate. Say the data includes logs & DBs. Thanks a million

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The internal logs have per-host throughput metrics that may get you started.  You'll have map hosts to OS yourself, however.

index=_index component=Metrics group=per_host_thruput
---
If this reply helps you, an upvote would be appreciated.

SamHTexas
Builder

Thanks very much as usual bro. How would I estimate this size of ingestion from a remote server that does not have Splunk on it. Am trying to get an rough estimate of an average server sending my company daily Windows + Linux logs + DBs. Thanks a bunch.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Look at comparable servers that are sending to Splunk and then say "amount this much".

---
If this reply helps you, an upvote would be appreciated.
0 Karma

PickleRick
Champion

There is no such thing. It varies greatly depending on what you're logging, how detailed your logging is, what is the server's role, how heavily it's used and so on.

It's like asking "what's a typical vehicle's fuel consumption".

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!