https://community.splunk.com/t5/Splunk-Dev/internal-index-is-huge/m-p/406852#M7008 <P>indexing rate per index for one of the index is abnormal, last 1-week _internal index vs others metric logs has a huge ratio difference. can u tell what will be a possible solution for this, the Same question I just asked from my another account, u can reply to this I'd suggest me how to try?</P> Wed, 16 Jan 2019 17:43:19 GMT Rajasekhar89 2019-01-16T17:43:19Z https://community.splunk.com/t5/Splunk-Dev/internal-index-is-huge/m-p/406852#M7008 <P>indexing rate per index for one of the index is abnormal, last 1-week _internal index vs others metric logs has a huge ratio difference. can u tell what will be a possible solution for this, the Same question I just asked from my another account, u can reply to this I'd suggest me how to try?</P> Wed, 16 Jan 2019 17:43:19 GMT https://community.splunk.com/t5/Splunk-Dev/internal-index-is-huge/m-p/406852#M7008 Rajasekhar89 2019-01-16T17:43:19Z https://community.splunk.com/t5/Splunk-Dev/internal-index-is-huge/m-p/406853#M7009 <P>The _internal index logs the activities that Splunk performs as well as the actions of the users. On a busy system, this can easily be a lot of data. Fortunately, _internal does not count toward your license so you only pay for the storage. If storage is a problem, consider changing the retention period from the default of 30 days to a smaller value, like 14 days. Be aware that doing so may affect some searches like the 30-day license usage report.</P> Wed, 16 Jan 2019 18:21:26 GMT https://community.splunk.com/t5/Splunk-Dev/internal-index-is-huge/m-p/406853#M7009 richgalloway 2019-01-16T18:21:26Z