https://community.splunk.com/t5/Monitoring-Splunk/What-is-the-performance-impact-of-reducing-maxTotalDataSizeMB/m-p/240203#M2364 <P>Yes, I second this. While it does depend on your disk, I've done this several times for various reasons (usually poor planning on my part) and never had any noticable impact. It only takes a few seconds after restart and it's finished. Yes, I'm using SSDs under Splunk, but really, it basically is just deleting a few files from the file system. Pretty quick.</P> Fri, 11 Mar 2016 21:06:46 GMT Richfez 2016-03-11T21:06:46Z https://community.splunk.com/t5/Monitoring-Splunk/What-is-the-performance-impact-of-reducing-maxTotalDataSizeMB/m-p/240201#M2362 <P>Hi,</P> <P>I plan to reduce the maxTotalDataSizeMB of several indices and would like to know the impact on performance of Splunk / System.<BR /> E.g. Will there be considerable slowness, etc.? What are other considerations when doing this change?</P> <P>One index has size is 267GB and would be setting the maxTotalDataSizeMB from the default (500GB) to 80GB.</P> <P>Thanks.</P> Fri, 11 Mar 2016 12:21:08 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-is-the-performance-impact-of-reducing-maxTotalDataSizeMB/m-p/240201#M2362 emontano 2016-03-11T12:21:08Z https://community.splunk.com/t5/Monitoring-Splunk/What-is-the-performance-impact-of-reducing-maxTotalDataSizeMB/m-p/240202#M2363 <P>You'll see a lot of I/O activity, but I have not seen this hugely impact performance of a Splunk system. Try to do one index at a time (with a few hours or a day in between) instead of all at once to limit any performance impact if you're concerned about it though.</P> Fri, 11 Mar 2016 19:57:09 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-is-the-performance-impact-of-reducing-maxTotalDataSizeMB/m-p/240202#M2363 masonmorales 2016-03-11T19:57:09Z https://community.splunk.com/t5/Monitoring-Splunk/What-is-the-performance-impact-of-reducing-maxTotalDataSizeMB/m-p/240203#M2364 <P>Yes, I second this. While it does depend on your disk, I've done this several times for various reasons (usually poor planning on my part) and never had any noticable impact. It only takes a few seconds after restart and it's finished. Yes, I'm using SSDs under Splunk, but really, it basically is just deleting a few files from the file system. Pretty quick.</P> Fri, 11 Mar 2016 21:06:46 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-is-the-performance-impact-of-reducing-maxTotalDataSizeMB/m-p/240203#M2364 Richfez 2016-03-11T21:06:46Z