DCO-SOGs/6 SIEMs/Splunk/6.0splunkinfo.md

Storage Requirements

 ( Daily average indexing rate ) x ( retention policy ) x 1/2

Parts of distributed splunk

• more indexers increase I/O capacity on disks

Capacity Planning