Splunk Dev

Reduce an index size

skippylou
Communicator

Couldn't find exact clarification on a couple things regarding reducing an index size but assuming how I think it will work, hoping someone has the definitive answer out there.

If say I have an index that has a max size setting of 50g. Let's say this index is currently using 45g of it.

I now want to reduce the max size for that index to 30g. After restarting splunk will it:

1) Purge data to get under the 30g limit? (assuming also it would then remove older buckets as necessary to stay under that limit as new data comes in moving forward - much as my current indexes that have hit limits do).

2) Start purging the oldest buckets first?

I assume on both it "does the right thing", but wanted to make sure there weren't any hidden caveats before doing this.

Thanks,

Scott

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

From my experience, the answer to both questions is "yes". Note that the "purge" will actually involve running the coldToFrozenScript on the oldest buckets (in the oldest-to-newest order) until the index gets under it's maxTotalDataSizeMB.

View solution in original post

hexx
Splunk Employee
Splunk Employee

From my experience, the answer to both questions is "yes". Note that the "purge" will actually involve running the coldToFrozenScript on the oldest buckets (in the oldest-to-newest order) until the index gets under it's maxTotalDataSizeMB.

skippylou
Communicator

awesome, thanks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...