We created a new index called "foo"; its size is about 6.6GB on disk. Our main index "main" is 66GB.
Our daily indexing volume stat went from about 1.7GB (before adding index ens) to > 19GB. How is that possible? Should not that stats have gone up about 10%?
The rawdata within the index is compressed, so we try to make the actual disk footprint as small as possible. If you want to take a copy of one of the files in $SPLUNK_DB/foo/db//rawdata and uncompress it to assess the compression ratio, go right ahead.
The rawdata within the index is compressed, so we try to make the actual disk footprint as small as possible. If you want to take a copy of one of the files in $SPLUNK_DB/foo/db//rawdata and uncompress it to assess the compression ratio, go right ahead.