How Splunk calculates disk storage
This topic discusses how Splunk calculates disk storage.
At a high level, Splunk calculates total disk storage as follows:
( Daily average indexing rate ) x ( retention policy ) x 1/2
If you want to base your calculation on the specific type(s) of data that Splunk will index, you can use the method described in "Estimate your storage requirements" in this manual.
Splunk stores raw data at up to approximately half its original size due to compression. On a volume that contains 500 GB of usable disk space, this means you can store nearly 6 months' worth of data at an indexing rate of 5 GB/day, or 10 days' worth at a rate of 100 GB/day.
If you need additional storage, you can opt for either more local disks (required for frequent searching) or attached or network storage (acceptable for occasional searching). Low-latency connections over NFS or SMB/CIFS (Server Message Block/Common Internet File System) are acceptable for searches over long time periods where instant search returns can be compromised to lower cost per GB.
Important: Shares mounted over a Wide Area Network (WAN) connection or on standby storage such as tape are never suitable storage choices for Splunk operations.
How Splunk apps affect Splunk performance
This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18