Hi Splunkers!
So as part two of my storage estimation (part one HERE), I have to allow for the growth & storage of the internal indexes in the following environment: - 100GB/day - 90 days data retention
Using the rough estimation of daily volume x retention x 1/2 I get 4.5TB of storage required for the above specs.
What kind of percentage buffer should I be applying for my Splunk Internal indexes (i.e. _internal, _audit, _fishbucket, etc..). I vaguely recall seeing a value of 15% being mentioned somewhere but that may have applied to something else.
Thanks in advance :-)