gkanpathy, I changed my settings to: [av_lookup] filename = av_lookup.csv max_offset_secs = 86400 min_offset_secs = -86400 time_field = savreportcheckin and I unable to perform any lookups at all. I thought it might of been a time_format issue, so I changed my time_format to: time_format = %Y-%m-%d %H:%M:%S and it still is broken. I removed the min and max the lookups started working again. Any thoughts on a setting that I might be missing or have wrong ? ... View more

RAID 5 is not a good storage solution for Splunk, as it is slow, and Splunk can only work as fast as the storage volume can, so if you're interested in fast performance, don't go down that route. Another consideration is 100GB of data doesn't necessarily equate to 100GB of disk-space when indexed. The compression ratio depends on the data, but you could find that 100GB equates to 50GB of space within $SPLUNK_DB . The only way to know for sure, is to run some tests with known data volumes. Also remember that cheap NFS storage is perfectly acceptable for older data you don't search very often ... View more