Splunk App for Windows Infrastructure Index Size

[pmatakevich]

Hello Splunk Community!

I currently have Splunk App for Windows Infrastructure configured and deployed to several Universal Forwarders. Most of this is working good, and I am working out some things with it but before I go much further I am trying to find out how to cut back on the amount of process related data I am ingesting. 

In 3 short months my windows index is almost 500gb in size! Briefly looking into the index I can see that a massive amount of events are related to the process category, and while we're interested in seeing process related data, its definitely not our top concern and this data seems to be dominating the index. 

Does anyone have suggestions for how I could cut this back? 

[gcusello]

Hi @pmatakevich,

one question: is your problem license consuption or storage occupation?

if your problem is license consuption, the only way to intervene is to disable some input (in inputs.conf) , as e.g. perfmons, to reduce the volume od indexed logs.

You could also reduce (in inputs.conf) the frequency of scripts' execution, but redution isn't so high.

If instead your problem is storage, you can intervene as before limiting inputs or reducing retention (modifying the frozenTimePeriodInSecs parameter in indexes.conf.) or max index size (https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Configureindexstoragesize).

Ciao.

Giuseppe