Monitoring Splunk

What is the performance impact of reducing maxTotalDataSizeMB?

emontano
New Member

Hi,

I plan to reduce the maxTotalDataSizeMB of several indices and would like to know the impact on performance of Splunk / System.
E.g. Will there be considerable slowness, etc.? What are other considerations when doing this change?

One index has size is 267GB and would be setting the maxTotalDataSizeMB from the default (500GB) to 80GB.

Thanks.

0 Karma
1 Solution

masonmorales
Influencer

You'll see a lot of I/O activity, but I have not seen this hugely impact performance of a Splunk system. Try to do one index at a time (with a few hours or a day in between) instead of all at once to limit any performance impact if you're concerned about it though.

View solution in original post

masonmorales
Influencer

You'll see a lot of I/O activity, but I have not seen this hugely impact performance of a Splunk system. Try to do one index at a time (with a few hours or a day in between) instead of all at once to limit any performance impact if you're concerned about it though.

Richfez
SplunkTrust
SplunkTrust

Yes, I second this. While it does depend on your disk, I've done this several times for various reasons (usually poor planning on my part) and never had any noticable impact. It only takes a few seconds after restart and it's finished. Yes, I'm using SSDs under Splunk, but really, it basically is just deleting a few files from the file system. Pretty quick.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...