Getting Data In

Reduce size of index after amount of time

gpareesi11
Path Finder

Hi,
I'm currently looking if it possible to reduce the amount of data store in index after 6 months.

Example:
I'm collecting CPU performance metric at each second for my server, after 6 months is it possible to reduce the size by keeping only CPU performance metric on 5 minutes interval for the next 6 months ?

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Once data is indexed it cannot be deleted until the whole bucket ages out. There is a delete command, but it hides data rather than remove it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gpareesi11
Path Finder

I understand this part, but when the bucket ages out, I don't need to delete everything but keep a different log interval to reduce the amount of data kept on storage.

I still need some dashboard and report but based on 5 minutes log interval instead of 1 second ?

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider a summary index. Sample your 6-month-old data at 5-minute intervals and write it to a summary index with its own 6-month lifespan.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gpareesi11
Path Finder

Great thanks

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...