Splunk Search

index storage config

dall
Path Finder

Hi 

We have a stand alone environment in which daily 100 GB data will be ingested,  just want to know what would be the best index storage configuration in indexes.conf.

i have no. of indexes

i want to configure like this

[active-directory]

homePath= $SPLUNK_DB/active_directory/db

coldPath= $SPLUNK_DB/active_directory/colddb

thawedPath= $SPLUNK_DB/active_directory/thaweddb

maxHotBuckets=3

maxDataSize=300

maxWarmDBCount=300

maxTotalDataSizeMB=200000

frozenTimePeriodInSecs=172800

 coldToFrozenDir= $SPLUNK_DB/ active_directory /frozendb

 

Can someone will help with suitable configuration, and what would be the disk space required to storage

if i ll config foe all indexes , ll i  face any disk space issue??

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @dall,

only one information: do you really want to setup a retention of only two days?

Anyway, storage requiremnt is the following:

  • V = average of daily indexed logs (you can use also your license value);
  • C = compression factor: 0.5
  • R = retention (in days);
  • N = number of Indexers (1).

So your storage requiement is:

S = V * C * R / N = 100 * 0.5 * 2 / 1 = 100GB

Ciao.

Giuseppe

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!