topic Re: Creating multiple indexes in Deployment Architecture https://community.splunk.com/t5/Deployment-Architecture/Creating-multiple-indexes/m-p/167443#M23263 <P>If you don't specify an index, then it can increase search time. </P> <P>If you specify an index, it will reduce search time. </P> <P>Splunk does not care how many indexes you have, but you might if you cannot easily specify the index that contains the data you're looking for.</P> Wed, 26 Feb 2014 23:14:45 GMT lukejadamec 2014-02-26T23:14:45Z Creating multiple indexes https://community.splunk.com/t5/Deployment-Architecture/Creating-multiple-indexes/m-p/167442#M23262 <P>I just wanted to check to see how everyone goes about creating indexes. Right now, we seem to be creating a new index for each source that we ingest into splunk. So my question is - are we going about this wrong? Should we be putting more data in main? What are the pros and cons of creating separate indexes vs putting everything together in fewer indexes?</P> Wed, 26 Feb 2014 22:56:51 GMT https://community.splunk.com/t5/Deployment-Architecture/Creating-multiple-indexes/m-p/167442#M23262 louieb3 2014-02-26T22:56:51Z Re: Creating multiple indexes https://community.splunk.com/t5/Deployment-Architecture/Creating-multiple-indexes/m-p/167443#M23263 <P>If you don't specify an index, then it can increase search time. </P> <P>If you specify an index, it will reduce search time. </P> <P>Splunk does not care how many indexes you have, but you might if you cannot easily specify the index that contains the data you're looking for.</P> Wed, 26 Feb 2014 23:14:45 GMT https://community.splunk.com/t5/Deployment-Architecture/Creating-multiple-indexes/m-p/167443#M23263 lukejadamec 2014-02-26T23:14:45Z Re: Creating multiple indexes https://community.splunk.com/t5/Deployment-Architecture/Creating-multiple-indexes/m-p/167444#M23264 <P>Thousands of indexes is overkill <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> from a couple to a dozen of indexes is a good start. all depends of your volume.</P> <P>Having several indexes is useful for :</P> <UL> <LI>access control, with permissions role/index</LI> <LI>retention, to have different size/time retentions per index</LI> <LI>search performances, by searching on a specific index</LI> </UL> Wed, 26 Feb 2014 23:25:39 GMT https://community.splunk.com/t5/Deployment-Architecture/Creating-multiple-indexes/m-p/167444#M23264 yannK 2014-02-26T23:25:39Z