topic Re: Shrink or reduce indexer in Getting Data In

Shrink or reduce indexer

nikhilmehra79 — Mon, 10 Nov 2014 02:02:58 GMT

HI,

I have been gathering data on an indexer for more than 2 years and though data has been useful but i think we can reduce the data to 1.5 yrs, is there is a way to shrink truncate indexers?

What are recommended ways to maintain life of data, i know ageing from hot to warl to cold buckets is something i have heard of not sure how it works (does splunk automatically take care of it or is something i need to do as admin?)

Re: Shrink or reduce indexer

tom_frotscher — Mon, 10 Nov 2014 09:13:57 GMT

Hi,

there are two ways to control the size of your indexes: size and time.

When you create or configer an index, you can give the index a maximum size (maxTotalDataSizeMB). Whenever this size is reached, events are frozen. This can be done via WebUI. The second option is to configure a time period, whenever all events are older than the time period, the events are frozen (frozenTimePeriodInSecs). If you have no action defined for the transition to frozen (for example a script) the events are deleted. You can find additional infos here: link.

Greetings

Tom

Re: Shrink or reduce indexer

kristian_kolb — Mon, 10 Nov 2014 19:46:17 GMT

And it might be worth to mention that since both of these settings have a default value, the discarding of data will be triggered by whichever of these limits gets hit first.

So if you want to use time as a limiting factor, ensure that you set the maxTotalDataSizeMB so high that you can be certain that frozenTimePeriodInSecs will trigger before the size constraint. And vice versa.