Splunk IT Service Intelligence

In Splunk IT Service Intelligence, what are the required log sources and expected volumes of data?

evelenke
Contributor

Hi Splunkers,

I will appreciate any approximate estimates on expected volumes and sources of data that will satisfy general needs for a nice functionality of ITSI in a mixed environment with, for example, 100 or 1000 hosts.

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @evelenke

This is an almost impossible question to answer as it can be heavily customised and all customers are different.

Here is some very very rough numbers for you to consider, but please talk to your Splunk sales rep:

Windows servers: ~ 250MB/server
Unix servers: ~500MB/day
Virtualization logs: ~500MB/day
Cloud logs: ~500MB/day
Other monitoring, such as website checks etc: 250MB/day

Hope this is helpful. I have take the numbers from the Splunk DSA checklist, but you should not rely on these figures for anything.

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Hi @evelenke

This is an almost impossible question to answer as it can be heavily customised and all customers are different.

Here is some very very rough numbers for you to consider, but please talk to your Splunk sales rep:

Windows servers: ~ 250MB/server
Unix servers: ~500MB/day
Virtualization logs: ~500MB/day
Cloud logs: ~500MB/day
Other monitoring, such as website checks etc: 250MB/day

Hope this is helpful. I have take the numbers from the Splunk DSA checklist, but you should not rely on these figures for anything.

evelenke
Contributor

Any rough calculation is helpful, thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...