Free Tool
Splunk Storage Sizing Calculator
Calculate your Splunk infrastructure requirements based on data ingestion, retention policies, and cluster configuration.
Input Data
Estimate the average daily amount of data to be ingested
100 GB/day
1 GB2 TB
15%
35%
Daily Indexed Storage (Standalone)50.00 GB/day
100.00 GB raw × (15% compression + 35% metadata)
Data Retention
Specify the amount of time to retain data for each storage tier
30d
60d
275d
Day 0Total: 365 days
Hot/Warm: 30d
Cold: 60d
Frozen: 275d
Cluster Architecture
Configure indexer clustering for high availability and data redundancy
3
120
Daily Ingest per Indexer
100.00 GB ÷ 3 indexers
33.33 GB/day
Replicates data across multiple indexers for fault tolerance
Storage Required
Total storage requirement breakdown
Tier
Per Indexer
Total
Hot/Warm
500.00 GB
1.50 TB
Cold
1.00 TB
3.00 TB
Frozen
1.38 TB
4.13 TB
Total
2.88 TB
8.63 TB
indexes.conf
# indexes.conf # Generated by datadefend Splunk Sizing Calculator # ================================================ # Daily Raw Volume: 100.00 GB # Daily Indexed Storage (standalone): 50.00 GB # Daily Indexed Storage (with RF/SF): 50.00 GB # Indexer Count: 3 # Replication Factor: 1 # Search Factor: 1 # ================================================ [volume:hot] path = /opt/splunk/var/lib/splunk/hot maxVolumeDataSizeMB = 512000 [volume:cold] path = /opt/splunk/var/lib/splunk/cold maxVolumeDataSizeMB = 1024000 [volume:frozen] path = /opt/splunk/var/lib/splunk/frozen maxVolumeDataSizeMB = 1408000 [default] repFactor = 0 homePath = volume:hot/$_index_name/db coldPath = volume:cold/$_index_name/colddb thawedPath = $SPLUNK_DB/$_index_name/thaweddb coldToFrozenDir = volume:frozen/$_index_name/frozendb # Retention settings maxWarmDBCount = 300 maxHotSpanSecs = 86400 maxHotBuckets = 10 maxDataSize = auto_high_volume frozenTimePeriodInSecs = 31536000 # Index definition example [main] homePath = volume:hot/main/db coldPath = volume:cold/main/colddb thawedPath = $SPLUNK_DB/main/thaweddb coldToFrozenDir = volume:frozen/main/frozendb maxTotalDataSizeMB = 1536000 frozenTimePeriodInSecs = 31536000
This calculator provides estimates based on typical Splunk deployments. Actual requirements may vary based on data characteristics, search patterns, and specific use cases.