All Apps and Add-ons

Splunk App for Windows Infrastructure Index Size

New Member

Hello Splunk Community!

I currently have Splunk App for Windows Infrastructure configured and deployed to several Universal Forwarders. Most of this is working good, and I am working out some things with it but before I go much further I am trying to find out how to cut back on the amount of process related data I am ingesting. 

In 3 short months my windows index is almost 500gb in size! Briefly looking into the index I can see that a massive amount of events are related to the process category, and while we're interested in seeing process related data, its definitely not our top concern and this data seems to be dominating the index. 

Does anyone have suggestions for how I could cut this back? 

Labels (2)
0 Karma

Esteemed Legend

Hi @pmatakevich,

one question: is your problem license consuption or storage occupation?

if your problem is license consuption, the only way to intervene is to disable some input (in inputs.conf) , as e.g. perfmons, to reduce the volume od indexed logs.

You could also reduce (in inputs.conf) the frequency of scripts' execution, but redution isn't so high.

If instead your problem is storage, you can intervene as before limiting inputs or reducing retention (modifying the frozenTimePeriodInSecs parameter in indexes.conf.) or max index size (



0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...