Dear @gcusello , Thank you for your advice, As your recommnedation, I just do these steps (please fix me if I'm wrong): 1) Using Splunk Clustering Daily License Usage as a Daily Data Volume (Example: 10GB per day) 2) Using Splunk Sizing site to calculate with retention policy requirement 3) Configuring indexes.conf as your recommendation for each volume [volume:hotwarm] path = /mnt/hotwarm_disk maxVolumeDataSizeMB = 102400 #100G [volume:cold] path = /mnt/cold_disk maxVolumeDataSizeMB = 204,800 #200G #Frozen Disk: /mnt/frozen_disk is 410G [idx] homePath = volume:hotwarm/defaultdb/db coldPath = volume:cold/defaultdb/colddb thawedPath = $SPLUNK_DB/defaultdb/thaweddb frozenTimePeriodInSecs = 7776000 #90 days searchable coldToFrozenDir = /mnt/frozen_disk/defaultdb/frozendb   Thanks & Best regards. ... View more

Dear @gcusello  Thanks you for your advice, I think frozenTimePeriodInSecs is not enough, We need to define homePatch.maxDatasizeMB, coldPath.maxDataSizeMB, maxTotalsizeMB. Then summary all Index capacity to define disk capacity for our retention polices. For example below: [idx_fgt] <other settings> homePath.maxDataSizeMB = 101200 # ~100GB coldPath.maxDataSizeMB = 256000 # 250GB maxTotalDataSizeMB = 357200 frozenTimePeriodInSecs = 15552000 [idx_windows] <other settings> homePath.maxDataSizeMB = 201200 # ~200GB coldPath.maxDataSizeMB = 356000 # ~350GB maxTotalDataSizeMB = 557200 frozenTimePeriodInSecs = 31536000   Summary [idx_fgt] and [idx_windows] we got for each indexer instance: ~300GB capacity for volume ../hot_warm/ ~600GB capacity for volume ../cold/ Our final goal is calculate addtitional capacity for disks on indexer instance. That's why in the title, we need to calculate Daily Data Volume 😄 More any suggestion from you ? Thanks & best regards. ... View more

Hi @livehybrid , Thank you for your anwser, FYI, I have separated the index for each device or vendor because each device has different data retention policies. Due to it, I need to calculate "Daily Data Volume" and configure stanza for each index on indexes.conf For example: [idx_fgt] (180 days searchable) [idx_windows] (365 days searchable) Can I use *license_usage.log* by each index for this situation ? Thanks & best regards. ... View more

Hi @gcusello , Thank you for your anwser, FYI, I have separated the index for each device or vendor because each device has different data retention policies. Due to it, I need to calculate "Daily Data Volume" and configure stanza for each index on indexes.conf For example: [idx_fgt] (180 days searchable) [idx_windows] (365 days searchable)   Do you have any suggestion ?   Thanks & best regards. ... View more

Dear @livehybrid, yes I confirm that my Splunk instances are running on VMs Query 1 Query 2 Regards. ... View more

Dear ITWhisperer, Thanks you for your suggestion, Actually, we planning to move Splunk Enterprise to new network zone, that means IPs are not statically. Then we define DNS Server to all Splunk Instances to they can be resolve each others. Regards. ... View more

Dear MiniNenya, According to your explain, how did you calculate "average amount of data ingested by each index" ? Sincerely, Benny On   ... View more

Thank you for your information. Actually, my company is an Splunk Partner so I can login to demo sites. Moreover, I'm still seeking for a RAW commonly data source for customize and fully control to my own Splunk. Regard. ... View more

Thank you Giuseppe, I have found static Splunk enterprise security demo site. I appreciate your help.  ... View more