What is the anticipated storage needs / growth after Splunk is implemented? Is there a formula based upon number of hosts / devices?
FYI max index size is set to 500GB by default, burned us when we found out our older data was getting deleted since it was over that default value.
If you have Splunk in place you can use this to help you estimate storage requirements.
http://docs.splunk.com/Documentation/Splunk/latest/Installation/Estimateyourstoragerequirements
Generally speaking, based on the amount of data coming into splunk (per day) you can estimate the need for about 50% of that amount. Then you'll need to take into account your retention requirements. So daily average volume of data x retention policy in days x 50%. If you are using summary indexing in a large environment you'll most likely want to use 60%.
If you have a larger environment > 2 GB per day then look here: