Monitoring Splunk

How is my indexed data stored/compressed on disk?

mctester
Communicator

We created a new index called "foo"; its size is about 6.6GB on disk. Our main index "main" is 66GB.

Our daily indexing volume stat went from about 1.7GB (before adding index ens) to > 19GB. How is that possible? Should not that stats have gone up about 10%?

Tags (2)
0 Karma
1 Solution

Mick
Splunk Employee
Splunk Employee

The rawdata within the index is compressed, so we try to make the actual disk footprint as small as possible. If you want to take a copy of one of the files in $SPLUNK_DB/foo/db//rawdata and uncompress it to assess the compression ratio, go right ahead.

View solution in original post

Mick
Splunk Employee
Splunk Employee

The rawdata within the index is compressed, so we try to make the actual disk footprint as small as possible. If you want to take a copy of one of the files in $SPLUNK_DB/foo/db//rawdata and uncompress it to assess the compression ratio, go right ahead.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...