What are Splunks storage requirements?
With default processing Splunk uses about 40% of the uncompressed raw log volume for standard syslog data and up to 100% for many other common log formats. Some data sources and configurations (such as heavy use of meta-events) may cause Splunk to use more while lowering density of indexing can reduce utlization to as little as 12%. In general, Splunk offers the highest search performance at the lowest storage cost relative to any other technology for log data retention.
