In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files.
What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?
To calculate the daily disk consumption per indexer in an indexer cluster, you need the total daily indexing volume to understand the amount of incoming data. The replication factor (RF) and search factor (SF) are crucial as they determine how many copies of the data and index files are stored and how many peers are involved in searching. Additionally, the number of peer nodes is necessary to distribute the data across them and determine the per-indexer storage requirements. This information will give a clear understanding of the total data stored and searched, which directly impacts disk consumption.
My answer is B
My answer is B as well.
It is B. Look at page 95-96 Architecting Splunk and it talks about considerations will include RF, SF and Daily index volume
pg 27 | Cluster
indexing volume, no. of peer nodes, RF and SF.
Actually I think D is right. I will explain. In B you have: number of peer nodes, but you do not need that to calculate the disk usage as you don't care about number of peers only about the size of data and search factor + replication factor. Now it is said that you can see how much data comes in a day. Bucket = half the size so you can actually see the size of the bucket. So you do not need the size of the daily data. But if you need to calculate consumption of disk in % you would need answer from D being the size of the disk system.
so why do you need number of accelerated searches?
You need to know the number of peers to know the average per peer. If you have an RF=3 among 5 peers, then the average is lower than it would be among 3 peers.
Answer B
Architecting Splunk PDF - page 96