Determining data capacity for an index is a non-trivial exercise. Which of the following are possible considerations that would affect daily indexing volume? (select all that apply)

Question

Options

• AAverage size of event data.
• BNumber of data sources.
• CPeak data rates.
• DNumber of concurrent searches on data.

Explanation

Options A, B, and C are all correct - the number of concurrent searches (D) is the distractor.

Daily indexing volume is determined by how much data flows into the system, so average event size (A) directly scales total bytes ingested, the number of data sources (B) multiplies the streams of incoming data, and peak data rates (C) determine burst capacity that must be sustained - all three drive how much the indexer must process each day. Concurrent searches (D) is wrong because searches read already-indexed data; they consume compute and memory resources but contribute nothing to the volume of data being written to the index.

Memory tip: Think of indexing volume as a write-side problem - anything that affects how much data enters the pipeline (size, sources, rate) counts. Search load is a read-side concern and belongs to a different capacity dimension.

No community discussion yet for this question.