Splunk merges config files from apps before it decides what to do so, no, having multiple input.conf files will not result in duplicate inputs. ... View more

@gcusello @isoutamo  Thanks for the replies. It seems this is not the behaviour for Splunk when it comes to HF, Cluster Master or Deployer. I manually added a bunch of apps on each server and then later assigned serverclasses with different apps. It left all the apps that were previously added manually.  From a deployment perspective this is good news. However i agree that it should either be managed manually, or with a DS, not both. My question was more based around whether it would delete all the stuff on the existing servers if i suddenly connect it to a DS with a serverclass - the answer now tested being no it wouldnt.  ... View more

The Monitoring Console should have that information. ... View more

Remote Object Store sizing = Daily Ingest Rate x Compression Ratio x Retention period Compression ratio is generally 50% (15% from the compression of rawdata and 35% from the tsidx metadata files) but this is entirely dependent on the type of data. For higher cardinality data, this percentage can go down resulting in lower compressed data or increase in the storage sizing requirement. Global Cache sizing = Daily Ingest Rate x Compression Ratio x (RF x Hot Days + (Cached Days - Hot Days)) Cache sizing per indexer = Global Cache sizing / No.of indexers Cached Days = Splunk recommends 30 days for Splunk Enterprise and 90 days for Enterprise Security Hot days = Number of days before hot buckets roll over to warm buckets. Ideally this will be between 1 and 7 but configure this based on how hot buckets rolls in your environment. read here: https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/SmartStoresystemrequirements https://docs.splunk.com/Documentation/Splunk/latest/Indexer/SmartStorearchitecture answer is from here: https://answers.splunk.com/answers/764258/smartstore-how-to-calculate-storage-requirements-f-1.html ... View more