Disk Space Consumption
There are various factors that go into your exact size, like long FQDNs or shorter names or how many legs each call has, but generally speaking:
To predict how much space you need per year
- 1,000,000 calls ends up being between 1 and 2 GB of data in Splunk.
— calculate how many calls you expect per year and divide that result by 500
to get GB
Initech does about 50
calls per month, what is their yearly disk usage?
calls per month, times 12
months is 600
calls per year. 600
divided by 500
per year of disk space.For your current size and consumption
, if you are an admin our recommendation is to check Splunk’s Monitoring Console
, especially the sections on Indexing: Indexes and Volumes
. From there you can get usage and size statistics on the cisco_cdr
Our data retention policies are actually just Splunk data retention policies. Splunk has a page on how to use their retention policies under the topic set a retirement and archiving policy in their documentation, and that page applies to our data as well as any other Splunk data.
If you left everything at their defaults when you created the cisco_cdr index, Splunk will keep
- up to 500 GB of data (which is 250,000,000,000 or more calls)
- for up to 6 years before starting to delete the oldest data.
Whichever threshold is met first will trigger the deletion of the oldest data to start. In many cases leaving the defaults for the index may work out fine, just check disk space consumption from time to time.
If not you can carefully adjust the various settings in their retirement and archiving policy docs to meet your needs.
If you need some help with these, or need some specific advice, contact us!
And as always, if you have any comments at all about the documentation, please send them to firstname.lastname@example.org.