How does this divide between files in the index?

The guidance Splunk gives for estimating size on for syslog data is 50% of original data size.

How does this divide between files in the index?
A . rawdata is: 10%, tsidx is: 40%
B . rawdata is: 15%, tsidx is: 35%
C . rawdata is: 35%, tsidx is: 15%
D . rawdata is: 40%, tsidx is: 10%

View Answer

Answer: B

Explanation:

The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. This divides between files in the index as follows: rawdata is 15%, tsidx is 35%. The rawdata is the compressed version of the original data, which typically takes about 15% of the original data size. The tsidx is the index file that contains the time-series metadata and the inverted index, which typically takes about 35% of the original data size. The total size of the rawdata and the tsidx is about 50% of the original data size. For more information, see [Estimate your storage requirements] in the Splunk documentation.