Deployment Architecture

splunk storage growth

dfosullivan
New Member

What is the anticipated storage needs / growth after Splunk is implemented? Is there a formula based upon number of hosts / devices?

Tags (1)
0 Karma

adamw
Communicator

FYI max index size is set to 500GB by default, burned us when we found out our older data was getting deleted since it was over that default value.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

If you have Splunk in place you can use this to help you estimate storage requirements.

http://docs.splunk.com/Documentation/Splunk/latest/Installation/Estimateyourstoragerequirements

Generally speaking, based on the amount of data coming into splunk (per day) you can estimate the need for about 50% of that amount. Then you'll need to take into account your retention requirements. So daily average volume of data x retention policy in days x 50%. If you are using summary indexing in a large environment you'll most likely want to use 60%.

If you have a larger environment > 2 GB per day then look here:

http://docs.splunk.com/Documentation/Splunk/latest/Installation/CapacityplanningforalargerSplunkdepl...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...