Getting Data In

Shrink or reduce indexer

nikhilmehra79
Path Finder

HI,

I have been gathering data on an indexer for more than 2 years and though data has been useful but i think we can reduce the data to 1.5 yrs, is there is a way to shrink truncate indexers?

What are recommended ways to maintain life of data, i know ageing from hot to warl to cold buckets is something i have heard of not sure how it works (does splunk automatically take care of it or is something i need to do as admin?)

0 Karma

tom_frotscher
Builder

Hi,

there are two ways to control the size of your indexes: size and time.

When you create or configer an index, you can give the index a maximum size (maxTotalDataSizeMB). Whenever this size is reached, events are frozen. This can be done via WebUI. The second option is to configure a time period, whenever all events are older than the time period, the events are frozen (frozenTimePeriodInSecs). If you have no action defined for the transition to frozen (for example a script) the events are deleted. You can find additional infos here: link.

Greetings

Tom

0 Karma

kristian_kolb
Ultra Champion

And it might be worth to mention that since both of these settings have a default value, the discarding of data will be triggered by whichever of these limits gets hit first.

So if you want to use time as a limiting factor, ensure that you set the maxTotalDataSizeMB so high that you can be certain that frozenTimePeriodInSecs will trigger before the size constraint. And vice versa.

/k

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...