Getting Data In

How to get the total size of data in a distributed Splunk deployment ignoring replication

vzedbny
Engager

I would like to add a new indexer site to our distributed Splunk deployment but would like this new site to contain a single copy of all of the data that's currently in the deployment. To do this, I want to get the size of the entirety of 1 copy of our Splunk data. This will help me size the new site.

We have a monitoring console and the Indexes and Volumes metric has an "Index Size" -> "Total Across Deployment".
Does that number include replicated data or is this the total size of 1 copy of the data?

0 Karma

codebuilder
Influencer

Yes, that number includes replication. Divide the numbers by your replication factor.

----
An upvote would be appreciated and Accept Solution if it helps!
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...