https://community.splunk.com/t5/Splunk-Search/Uncompressed-Data/m-p/71221#M180816 <P>Neverminf, I misunderstood your question.</P> Tue, 14 Feb 2012 18:28:03 GMT dmaislin_splunk 2012-02-14T18:28:03Z https://community.splunk.com/t5/Splunk-Search/Uncompressed-Data/m-p/71218#M180813 <P>I have just turned on compression and have over 100 GB of uncompressed data. How can I compress it and Splunk still be able to read it?</P> <P>Let me rephrase. I have 100GB of already indexed uncompressed data. I have just configured compression from the forwarders to the indexers. How do I compress this data so splunk can read it in order to save some disk space?</P> Tue, 14 Feb 2012 14:58:45 GMT https://community.splunk.com/t5/Splunk-Search/Uncompressed-Data/m-p/71218#M180813 ryanmims 2012-02-14T14:58:45Z https://community.splunk.com/t5/Splunk-Search/Uncompressed-Data/m-p/71219#M180814 <P>Just point Splunk at the file. Splunk reads compressed files, but has to go through a single threaded process to decompress each compress file first and then read it in. Why not let Splunk read in uncompressed data and then compress it? Otherwise it would take a long time to read all that compressed data. It's not out of the ordinary to do it though. We see this all the time.</P> Tue, 14 Feb 2012 17:12:57 GMT https://community.splunk.com/t5/Splunk-Search/Uncompressed-Data/m-p/71219#M180814 dmaislin_splunk 2012-02-14T17:12:57Z https://community.splunk.com/t5/Splunk-Search/Uncompressed-Data/m-p/71220#M180815 <P>indexes already compressed when indexed. I just compressed the data for transfer.</P> Tue, 14 Feb 2012 18:14:11 GMT https://community.splunk.com/t5/Splunk-Search/Uncompressed-Data/m-p/71220#M180815 ryanmims 2012-02-14T18:14:11Z https://community.splunk.com/t5/Splunk-Search/Uncompressed-Data/m-p/71221#M180816 <P>Neverminf, I misunderstood your question.</P> Tue, 14 Feb 2012 18:28:03 GMT https://community.splunk.com/t5/Splunk-Search/Uncompressed-Data/m-p/71221#M180816 dmaislin_splunk 2012-02-14T18:28:03Z