We have a stand alone environment in which daily 100 GB data will be ingested, just want to know what would be the best index storage configuration in indexes.conf.
i have no. of indexes
i want to configure like this
coldToFrozenDir= $SPLUNK_DB/ active_directory /frozendb
Can someone will help with suitable configuration, and what would be the disk space required to storage
if i ll config foe all indexes , ll i face any disk space issue??
only one information: do you really want to setup a retention of only two days?
Anyway, storage requiremnt is the following:
So your storage requiement is:
S = V * C * R / N = 100 * 0.5 * 2 / 1 = 100GB