Getting Data In

Splunk indexing question

webelieve1111
Engager

Hi,
I am trying to estimate how much indexing I would need from my setup for Splunk and was wondering exactly how indexing is calculated. I know from documentation that there are 2 types of files: compressed data and index files. For Splunk Free, would both the compressed data and index files count towards the 500MB/day or would it just be the index files?

Thanks!

0 Karma
1 Solution

Gilberto_Castil
Splunk Employee
Splunk Employee

Splunk licensing is measured by the volume of data consumed in a daily basis. If you consume 500MB of raw data, then your license will count 500MB.

The licensing is not measured by the amount of data you keep stored with your Splunk instance.

View solution in original post

bmacias84
Champion

If you are using the free version of Splunk you can only index 500mb per day. The 500MB per day consists of raw data defined within your inputs.conf files on your indexers and forwarders and excludes Splunk internal logs.

To estimate how much data you will be indexing look at how large the log files are and multiply by number of logs. Do that for each set of logs for a rough estimate.

If you want to calculate disk storage requirements read this: EstimateIndexSize

Hope this helps and gets you started. CHeers.

Gilberto_Castil
Splunk Employee
Splunk Employee

Splunk licensing is measured by the volume of data consumed in a daily basis. If you consume 500MB of raw data, then your license will count 500MB.

The licensing is not measured by the amount of data you keep stored with your Splunk instance.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...