Splunk IT Service Intelligence

In Splunk IT Service Intelligence, what are the required log sources and expected volumes of data?

evelenke
Contributor

Hi Splunkers,

I will appreciate any approximate estimates on expected volumes and sources of data that will satisfy general needs for a nice functionality of ITSI in a mixed environment with, for example, 100 or 1000 hosts.

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @evelenke

This is an almost impossible question to answer as it can be heavily customised and all customers are different.

Here is some very very rough numbers for you to consider, but please talk to your Splunk sales rep:

Windows servers: ~ 250MB/server
Unix servers: ~500MB/day
Virtualization logs: ~500MB/day
Cloud logs: ~500MB/day
Other monitoring, such as website checks etc: 250MB/day

Hope this is helpful. I have take the numbers from the Splunk DSA checklist, but you should not rely on these figures for anything.

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Hi @evelenke

This is an almost impossible question to answer as it can be heavily customised and all customers are different.

Here is some very very rough numbers for you to consider, but please talk to your Splunk sales rep:

Windows servers: ~ 250MB/server
Unix servers: ~500MB/day
Virtualization logs: ~500MB/day
Cloud logs: ~500MB/day
Other monitoring, such as website checks etc: 250MB/day

Hope this is helpful. I have take the numbers from the Splunk DSA checklist, but you should not rely on these figures for anything.

View solution in original post

evelenke
Contributor

Any rough calculation is helpful, thanks a lot!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!