The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

Question

Options

• Arawdata is: 10%, tsidx is: 40%
• Brawdata is: 15%, tsidx is: 35%
• Crawdata is: 35%, tsidx is: 15%
• Drawdata is: 40%, tsidx is: 10%

• A
  5% (1)
• B
  90% (19)
• C
  5% (1)

Explanation

The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. This divides between files in the index as follows: rawdata is 15%, tsidx is 35%. The rawdata is the compressed version of the original data, which typically takes about 15% of the original data size. The tsidx is the index file that contains the time-series metadata and the inverted index, which typically takes about 35% of the original data size. The total size of the rawdata and the tsidx is about 50% of the original data size. For more information, see [Estimate your storage requirements] in the Splunk

No community discussion yet for this question.