topic Re: _internal large amounts of data incoming in Getting Data In

_internal large amounts of data incoming

zubairaizatron — Thu, 03 Sep 2020 09:17:29 GMT

i have an average of 100 events coming into the splunk _internal index per minute on a instance that is not very busy and is being used by 2 people. I reduced the bucket size to allow the data to roll over sooner to avoid a disk space error. are there any configurations that im missing that could slow down the incoming events.

Re: _internal large amounts of data incoming

gcusello — Thu, 03 Sep 2020 09:31:28 GMT

Hi @zubairaizatron,

all the events arrive from an inputs.conf configuration file, so you could reduce some logs to ingest, but I don't hint this.

All the Splunk logs could be useful to debug problems; eventually you could reduce the retention of _internal logs that are the most relevant.

By default it has 30 days retention, you could reduce it to 15 or 10 modifying indexes.conf in $SPLUNK_HOME/etc/system/local; if there isn't copy it from default folder and modify.

Anyway, _internal logs don't consume license.

Ciao.

Giuseppe

Re: _internal large amounts of data incoming

gcusello — Mon, 07 Sep 2020 08:01:13 GMT

Hi @zubairaizatron,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉