Files
DCO-SOGs/6 SIEMs/Splunk/6.0splunkinfo.md

11 lines
491 B
Markdown

### [Storage Requirements](https://docs.splunk.com/Documentation/Splunk/9.3.0/Capacity/HowSplunkcalculatesdiskstorage)
```
( Daily average indexing rate ) x ( retention policy ) x 1/2
```
#### [Parts of distributed splunk](https://docs.splunk.com/Documentation/Splunk/9.3.0/Capacity/Distributeindexingandsearching)
- more indexers increase I/O capacity on disks
#### [Capacity Planning](https://docs.splunk.com/Documentation/Splunk/9.3.0/Capacity/Accommodatemanysimultaneoussearches)