Splunk® Enterprise

Installation Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

How Splunk Enterprise calculates disk storage

This topic discusses how Splunk Enterprise calculates disk storage.

At a high level, Splunk calculates total disk storage as follows:

 ( Daily average indexing rate ) x ( retention policy ) x 1/2

If you want to base your calculation on the specific type(s) of data that Splunk Enterprise will index, you can use the method described in "Estimate your storage requirements" in this manual.

Splunk Enterprise stores raw data at up to approximately half its original size due to compression. On a volume that contains 500 GB of usable disk space, this means you can store nearly 6 months' worth of data at an indexing rate of 5 GB/day, or 10 days' worth at a rate of 100 GB/day.

If you need additional storage, you can opt for either more local disks (required for frequent searching) or attached or network storage (acceptable for occasional searching). Low-latency connections over NFS or SMB/CIFS (Server Message Block/Common Internet File System) are acceptable for searches over long time periods where instant search returns can be compromised to lower cost per GB.

Important: Shares mounted over a Wide Area Network (WAN) connection or on standby storage such as tape are never suitable storage choices for Splunk Enterprise operations.

PREVIOUS
How Splunk apps affect Splunk Enterprise performance
  NEXT
Reference hardware

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters