Hello community.
Thank you for looking at my question,
I am a Splunk newbie and probably have the dumbest question ever asked.
I have indexers, Heavy Forwarders and Search Heads,
My manager asked me to calculate if we are capable of ingesting 11.5TB of data for a retention of 3months, 11.5TB will be the total retention we will need.
I have several Indexers distributed, and several indexers, they gave me a clue that i have to sum all indexers, and that will give me free total space.
What I would like to know is:
is there an easy way to see on the deployer, or health check or in any other place or by a search string the real capacity I have, and the amount that I have left?
As I mentioned I have 11 indexers, some of they say show 20% used, others show 110% used, etc.
How is the appropriate way to calculate real free space?
Thank you!
↧