Creating Splunk indexes

Creating a custom index is a Splunk administrator’s responsibility. As you have seen, data is retained in indexes until it reaches a certain age or the index reaches a certain size, so an estimation of an index’s size before it is created is a crucial step. Having an accurate estimation retains the data for the necessary amount of time, and it also helps to determine the required storage capacity upfront.

In order to estimate the size of the index, we must have the answers to the following questions:

• Question: How long does the data need to be retained in days?

Answer: For example, 100 days

• Question: How much data volume per day is expected in GB?

Answer: For example, 1 GB

The formula for index size estimation is as follows:

Retain days X volume per day X 1/2 (raw data compression + index files)

If we substitute in the example values, the index size becomes 100 X 1 X (½) = 50 GB.

Now that you know...