Storage estimation in a data indexing and query system

A system comprising:

• a communication device through which to communicate on a computer network;
• and
• at least one processor operatively coupled to the communication device and configured to perform operations including
• receiving user inputs indicative that a first data source is to be a subject of a storage related estimate;
• receiving data generated by the first data source;
• parsing the data generated by the first data source into a first plurality of events;
• generating the storage related estimate, based on at least some of the first plurality of events;
• causing an indication of the storage related estimate to be output to a user;
• and
• completing an indexing of only a sample of the received first plurality of events based on a sampling criterion, and not completing indexing of a remainder of the first plurality of events in the absence of a user input indicative that the first data source should be indexed, the sample being fewer than all of the first plurality of events, wherein completing indexing includes committing data being indexed or to be indexed to persistent storage.

A non-transitory machine-readable storage medium for use in a processing system of a data intake and query system, the non-transitory machine-readable storage medium storing instructions, an execution of which in the processing system causes the processing system to perform operations comprising:

• receiving user inputs indicative that a first data source is to be a subject of a storage related estimate;
• receiving raw data generated by the first data source;
• parsing the raw data generated by the first data source into a first plurality of events;
• generating the storage related estimate, based on at least some of the first plurality of events;
• causing an indication of the storage related estimate to be output to a user;
• and
• completing indexing of only a sample of the received first plurality of events based on a sampling criterion, and not completing indexing of a remainder of the first plurality of events in the absence of a user input indicative that the first data source should be indexed, the sample being fewer than all of the first plurality of events, wherein completing indexing includes committing data being indexed or to be indexed to persistent storage.