Data Retention Policies

Disk Space Consumption

There are various factors that go into your exact size, like long FQDNs or shorter names or how many legs each call has, but generally speaking:

• 1,000,000 calls ends up being between 1 and 2 GB of data in Splunk. 

To predict how much space you need per year — calculate how many calls you expect per year and divide that result by 500,000 to get GB/​year.

Example: Initech does about 50,000 calls per month, what is their yearly disk usage?
Answer: 50,000 calls per month, times 12 months is 600,000 calls per year. 600,000 divided by 500,000 = 1.2 GB per year of disk space.

For your current size and consumption, if you are an admin our recommendation is to check Splunk’s Monitoring Console, especially the sections on Indexing: Indexes and Volumes. From there you can get usage and size statistics on the cisco_​cdr index.

Data Retention

Our data retention policies are actually just Splunk data retention policies. Splunk has a page on how to use their retention policies under the topic set a retirement and archiving policy in their documentation, and that page applies to our data as well as any other Splunk data.

If you left everything at their defaults when you created the cisco_​cdr index, Splunk will keep 

• up to 500 GB of data (which is 250,000,000,000 or more calls) 
  
• for up to 6 years before starting to delete the oldest data. 
  

Whichever threshold is met first will trigger the deletion of the oldest data to start. In many cases leaving the defaults for the index may work out fine, just check disk space consumption from time to time.

If not you can carefully adjust the various settings in their retirement and archiving policy docs to meet your needs.

If you need some help with these, or need some specific advice, contact us!

And as always, if you have any comments at all about the documentation, please send them to docs@​sideviewapps.​com.