https://community.splunk.com/t5/Getting-Data-In/What-options-are-available-to-offload-the-data-from-Splunk/m-p/379062#M94293 <P>There are several options for you. Please see below link for more detail.<BR /> <A href="https://splunk.box.com/v/dataoffload">https://splunk.box.com/v/dataoffload</A></P> <P>The quick win is the TSIDX reduction. <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Reducetsidxdiskusage">https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Reducetsidxdiskusage</A></P> <P>Hadoop data roll would be the next when you have any Hadoop storage space.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingindexestoHadoop">https://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingindexestoHadoop</A></P> <P>I hope this helps.</P> Mon, 30 Jul 2018 03:38:11 GMT tmurata_splunk 2018-07-30T03:38:11Z https://community.splunk.com/t5/Getting-Data-In/What-options-are-available-to-offload-the-data-from-Splunk/m-p/379061#M94292 <P>I'm currently facing an immediate situation where my Splunk Indexers are running of of the disk space. Please let me know what options are available.</P> Mon, 30 Jul 2018 03:27:40 GMT https://community.splunk.com/t5/Getting-Data-In/What-options-are-available-to-offload-the-data-from-Splunk/m-p/379061#M94292 tmurata_splunk 2018-07-30T03:27:40Z https://community.splunk.com/t5/Getting-Data-In/What-options-are-available-to-offload-the-data-from-Splunk/m-p/379062#M94293 <P>There are several options for you. Please see below link for more detail.<BR /> <A href="https://splunk.box.com/v/dataoffload">https://splunk.box.com/v/dataoffload</A></P> <P>The quick win is the TSIDX reduction. <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Reducetsidxdiskusage">https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Reducetsidxdiskusage</A></P> <P>Hadoop data roll would be the next when you have any Hadoop storage space.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingindexestoHadoop">https://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingindexestoHadoop</A></P> <P>I hope this helps.</P> Mon, 30 Jul 2018 03:38:11 GMT https://community.splunk.com/t5/Getting-Data-In/What-options-are-available-to-offload-the-data-from-Splunk/m-p/379062#M94293 tmurata_splunk 2018-07-30T03:38:11Z