How to assess the storage if we modify the index searchable retention days

[shoaibalimir]

Hi,

I have an use case in which I need to assess the storage difference of the index.

Like for example, I have an index which has around 100.15 GB of data in it with Searchable Retention Days as 1095 Days. Now, if I reduce the Searchable Retention Days to let's say 365 Days, then what would be the approximate storage utilization on the Index.

I need to output these results onto a tabular form on a dashboard for the same.

Please assist me on this.

Thank you in advance.

[shoaibalimir]

Hi @gcusello,

Thank you for sharing the formula for the storage, but is it applicable to Splunk Cloud?

Also the average license consumption, is it the data ingestion or the storage entitlement we are talking about?

Thanks in advance!

[gcusello · Accepted solution]

Hi @shoaibalimir ,

the formula is always the same, but anyway, on Splunk Cloud, you don't need to think to the required storage, because you have only to think about how many logs must be indexed every day, required storege is a problem of Splunk Cloud administrators.

In your contract you shoudl have defined the daily indexed volume and the retention period, storage isn't your problem.

The license consuption and the storage entitlement are two related but different values, you have to put attention only one license consuption to avoid to exceed the limit too times.

Ciao.

Giuseppe

[gcusello]

Hi @shoaibalimir ,

storage dimensioning is a job for an architect!

Aniway, it depends on if you have a cluster or not, if not you can calculate the storega in this way:

storage = (average_license_consuption_by_day / 2 )* retention

 if you have a cluster you must add the Replication Factor anf the Search Factor.

Ciao.

Giuseppe