Hi @gitingua,
what's the purpose of your question?
Could you better describe your requirement?
if you need to know what's the dayly volume of your installation, you can go at [Settings -- Licensing -- Usage Report -- Previous 60 days] and you'll have all the needed information.
In instead you have to analyze your infrastructure to make a correct order to Splunk it's more difficoult because you should analyze your systems and make a Capacity Plan.
Extremely simplifying:
- count the system in the perimeter of each kind (Windows servers, Linux Servers, Firewalls, network appliances, etc...)
- for each system find an average of the dayly events,
- for each system see the dimension of an event,
- make a calculation using a saving factor of 30%.
Ciao.
Giuseppe
