Getting Data In

What will be the size of the indexed data if I send 50GB of raw data to Splunk?

splunker12er
Motivator

I send daily 50 GB raw data from my machines to Splunk for indexing
what will be the size of the data after it got indexed ?

Will this be the same 50 Gb or indexed data will have less size ?

MuS
SplunkTrust
SplunkTrust

Hi splunker12er,

it all depends on your raw data, but basically you can say compression between 30-50% are normal, you can check this with this search:

 | dbinspect index=YOURINDEX
 | fields state,id,rawSize,sizeOnDiskMB 
 | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB
 | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
 | eval compression=tostring(round(diskTotalinMB / rawTotalinMB * 100, 2)) + "%"
 | table rawTotalinMB, diskTotalinMB, compression

cheers,

MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...