https://community.splunk.com/t5/Getting-Data-In/Reduce-clustered-index-COLD-which-becomes-oversized-over-time/m-p/533365#M89589 <P>Hello guys,</P><P>one clustered index is now oversized due to lower indexed data since several months and data froze over time.</P><P>The COLD size shows it only uses now 1 gb of ~4 gb so is it safe to reduce the COLD path and&nbsp;maxtotaldatasizemb? In my opinion it should have no effect on the index, it should not freeze current data?</P><P>Thanks for your help.</P><P>Enterprise 7.1.4</P> Wed, 16 Dec 2020 20:41:26 GMT splunkreal 2020-12-16T20:41:26Z https://community.splunk.com/t5/Getting-Data-In/Reduce-clustered-index-COLD-which-becomes-oversized-over-time/m-p/533365#M89589 <P>Hello guys,</P><P>one clustered index is now oversized due to lower indexed data since several months and data froze over time.</P><P>The COLD size shows it only uses now 1 gb of ~4 gb so is it safe to reduce the COLD path and&nbsp;maxtotaldatasizemb? In my opinion it should have no effect on the index, it should not freeze current data?</P><P>Thanks for your help.</P><P>Enterprise 7.1.4</P> Wed, 16 Dec 2020 20:41:26 GMT https://community.splunk.com/t5/Getting-Data-In/Reduce-clustered-index-COLD-which-becomes-oversized-over-time/m-p/533365#M89589 splunkreal 2020-12-16T20:41:26Z