Use Stream Estimate to preview index volume

The Stream Estimate dashboard shows index volume stats for all streams in Estimate mode. Streams in Estimate mode generate data index volume stats, without sending the actual data to your indexers.

You can use the Stream Estimate dashboard to preview the amount of data that you might need to index for any stream. This information can help you calculate your indexer requirements and configure your streams so that you capture only the data you require for analysis.

The Stream Estimate dashboard lets you monitor these data index volume stats:

• Total Events
• Total Incomming Traffic (MB)
• Total Outgoing Traffic (MB)
• Total Traffic (MB)
• Spunk Index Volume (MB)

In the Splunk App for Stream main menu, click Stream Estimate.

Note: Streams in Enabled mode generate data index volume stats based on the actual amount of data sent to your indexers. You can view index volume stats for all enabled streams in the Stream Data Volumes dashboard. For more information, see Admin Dashboards in this manual.

For more information on the Estimate mode, see Configure Streams in this manual.