Please check out lguinn's answer here, where she gives a recommendation to check the DMC (or install and use the SOS app on older versions) then gives a search that may help you discover why the discrepancy.
IMO, woodcock is likely correct (and his comments are completely correct regarding how that situation happens, if that is indeed what is happening.) There are a few other explanations possible, though.
40GB turning into 60GB is a big jump: if it had ended up only somewhat bigger (please use a very loose definition of "somewhat") then it could be tokenization and other things. Some inputs expand somewhat upon ingestion because of what needs to happen to them. I've seen inputs double their size, but IIRC that's not usually what syslog stuff does. Doesn't mean it can't, though.
One other non-impossible reason is that it isn't actually that much bigger. Instead, you are just seeing other inputs that you weren't aware of, had forgotten about or didn't realize were so large. Local OS information perhaps - some of those can be a bit chatty in certain circumstances. The DMC can help a lot to identify this if you dig around in the indexing section, or it may be as simple as clicking into the search app then clicking the "Data Summary" button and looking around in there.
Hope this helps!
... View more
