https://community.splunk.com/t5/Splunk-Dev/Reduce-an-index-size/m-p/17947#M106 <P>Couldn't find exact clarification on a couple things regarding reducing an index size but assuming how I think it will work, hoping someone has the definitive answer out there.</P> <P>If say I have an index that has a max size setting of 50g. Let's say this index is currently using 45g of it.</P> <P>I now want to reduce the max size for that index to 30g. After restarting splunk will it:</P> <P>1) Purge data to get under the 30g limit? (assuming also it would then remove older buckets as necessary to stay under that limit as new data comes in moving forward - much as my current indexes that have hit limits do).</P> <P>2) Start purging the oldest buckets first? </P> <P>I assume on both it "does the right thing", but wanted to make sure there weren't any hidden caveats before doing this.</P> <P>Thanks,</P> <P>Scott</P> Fri, 24 Dec 2010 02:41:19 GMT skippylou 2010-12-24T02:41:19Z https://community.splunk.com/t5/Splunk-Dev/Reduce-an-index-size/m-p/17947#M106 <P>Couldn't find exact clarification on a couple things regarding reducing an index size but assuming how I think it will work, hoping someone has the definitive answer out there.</P> <P>If say I have an index that has a max size setting of 50g. Let's say this index is currently using 45g of it.</P> <P>I now want to reduce the max size for that index to 30g. After restarting splunk will it:</P> <P>1) Purge data to get under the 30g limit? (assuming also it would then remove older buckets as necessary to stay under that limit as new data comes in moving forward - much as my current indexes that have hit limits do).</P> <P>2) Start purging the oldest buckets first? </P> <P>I assume on both it "does the right thing", but wanted to make sure there weren't any hidden caveats before doing this.</P> <P>Thanks,</P> <P>Scott</P> Fri, 24 Dec 2010 02:41:19 GMT https://community.splunk.com/t5/Splunk-Dev/Reduce-an-index-size/m-p/17947#M106 skippylou 2010-12-24T02:41:19Z https://community.splunk.com/t5/Splunk-Dev/Reduce-an-index-size/m-p/17948#M107 <P>From my experience, the answer to both questions is "yes". Note that the "purge" will actually involve running the coldToFrozenScript on the oldest buckets (in the oldest-to-newest order) until the index gets under it's maxTotalDataSizeMB.</P> Fri, 24 Dec 2010 06:15:23 GMT https://community.splunk.com/t5/Splunk-Dev/Reduce-an-index-size/m-p/17948#M107 hexx 2010-12-24T06:15:23Z https://community.splunk.com/t5/Splunk-Dev/Reduce-an-index-size/m-p/17949#M108 <P>awesome, thanks.</P> Sat, 25 Dec 2010 05:14:36 GMT https://community.splunk.com/t5/Splunk-Dev/Reduce-an-index-size/m-p/17949#M108 skippylou 2010-12-25T05:14:36Z