topic Re: Reducing Index Size in Splunk Search

How can I reduce the storage size of an index, what are the different methods/options?

foundationservi — Thu, 16 Mar 2023 15:21:06 GMT

Hi,

How can I reduce the storage size of an index, what are the different methods/options?

Also, will removing logs using the delete command reduce the storage size of an index?

Kind Regards,

Aftab

Re: Reducing Index Size

richgalloway — Mon, 10 Jan 2022 16:07:26 GMT

The delete command doesn't actually delete anything. It just marks events as hidden so they don't appear in search results so no storage is saved by that command.

The only way to reduce the space used by an index is to wait for Splunk to delete buckets as data ages or times out. You can accelerate that by changing the retention settings of that index and restarting the indexer(s).

That said, if you are using datamodel acceleration then that will consume storage on your index volume. That storage can be reduced by disabling DMA that is not used or by reducing the summary window for a DM.

Re: Reducing Index Size

nordinethales — Thu, 16 Mar 2023 10:06:37 GMT

Hello,

better way to reduce the size of index is to reduce retention period, or some other parameter of index configuration. You need splunk admin rights. Some info from the documentation:

Use these indexes.conf settings to configure data retention policies for a SmartStore index:

maxGlobalDataSizeMB
maxGlobalRawDataSizeMB
frozenTimePeriodInSecs

I hope it helps you

Regards