Implementing Splunk 7, Third Edition - Third Edition

Sizing an index

To estimate how much disk space is needed for an index, use the following formula:

(gigabytes per day) * .5 * (days of retention desired)

Likewise, to determine how many days you can store an index, the formula is essentially:

(device size in gigabytes) / ( (gigabytes per day) * .5 )

The .5 represents a conservative compression ratio. The log data itself is usually compressed to 10 percent of its original size. The index files necessary to speed up search brings the size of a bucket closer to 50 percent of the original size, though it is usually smaller than this.

If you plan to split your buckets across devices, the math gets more complicated unless you use volumes. Without using volumes, the math is essentially as follows: ...