Upload files to "6 SIEMs/Splunk"

6 SIEMs/Splunk/6.0splunkinfo.md

@@ -0,0 +1,10 @@
+### [Storage Requirements](https://docs.splunk.com/Documentation/Splunk/9.3.0/Capacity/HowSplunkcalculatesdiskstorage)
+
+```
+ ( Daily average indexing rate ) x ( retention policy ) x 1/2
+```
+
+ #### [Parts of distributed splunk](https://docs.splunk.com/Documentation/Splunk/9.3.0/Capacity/Distributeindexingandsearching)
+ - more indexers increase I/O capacity on disks
+
+ #### [Capacity Planning](https://docs.splunk.com/Documentation/Splunk/9.3.0/Capacity/Accommodatemanysimultaneoussearches)