[Deleted per request] ... View more

Hi @PickleRick , It is defined on the Splunk server. It's just a single instance that's all running on a single server (this is just a proof-of-concept that's going to be deleted once a sizing exercise is done). ... View more

Hi @venky1544 , Thanks for your help on this, that command is great. I'm still getting used to the more nitty-gritty parts of the Splunk config, so I'll chalk all this up to a newbie taking his lumps. 🙂 I've attached the output from that command you mentioned to this post. Do you see anything out of the ordinary? [Attachment deleted per request] ... View more

[Deleted per request] ... View more

Thanks! The 60-day trial really helps buy me some valuable time to collect some sample data to figure out just how big of a license I really need. Yeah, I quickly discovered that trying to estimate how much the ingestion rate will be should not be judged based on how large the Event Viewer log files are, or extracting one random event from the Event Viewer and saving it as either an individual exported event, or even copying and pasting the event into Notepad and saving it as a text file. Splunk seems to do a really good job of stripping excess data and only indexing the necessary stuff. Thanks for your help, I appreciate it! 🙂 ... View more

I deployed the UF to one test Windows server so I can test the waters on what to expect when I eventually deploy them on a mass scale, as well as verifying how large each event is that ultimately gets indexed. I learned a great deal so far on sizing through having this test instance of Splunk running. I saw that when the UF is first installed, the UF is going to send everything it has in the Event Viewer logs and any other log files/directories that I specified during setup to Splunk. I'll just say this is a great way to test whether or not my inputs.conf file(s) are working correctly. So unless either the inputs.conf files are working properly and/or I clear out all the logs on the server prior to installing the UF, I should be prepared for a bit of a tidal wave of events that get ingested at the very beginning from each server I have a UF installed on, but that's another story for another thread. 😅 Your estimate was right on the mark, though; the events being indexed coming in from that server's UF were averaging between 120-157 bytes each across several thousand events, so it looks like using 160 bytes as the general size of an event will be really beneficial in helping me more accurately estimate just how large of a license we actually need. I'll clear out the Event Viewer logs on my test server and reinstall the UF immediately afterwards so I can start to get a better idea of just how much log data a typical server generates on a typical day, and use that as a ballpark until more servers get the UF installed onto them (e.g. domain controllers). And by that math, it could very well be that the initial estimate 5GB of ingestion a day may very well turn out to be supreme overkill for my organization's needs (and rather costly for us), especially if I only have a limited scope of events I want Splunk to ingest. Thanks for your help! 😀 ... View more