Splunk Dev

Reduce an index size

skippylou
Communicator

Couldn't find exact clarification on a couple things regarding reducing an index size but assuming how I think it will work, hoping someone has the definitive answer out there.

If say I have an index that has a max size setting of 50g. Let's say this index is currently using 45g of it.

I now want to reduce the max size for that index to 30g. After restarting splunk will it:

1) Purge data to get under the 30g limit? (assuming also it would then remove older buckets as necessary to stay under that limit as new data comes in moving forward - much as my current indexes that have hit limits do).

2) Start purging the oldest buckets first?

I assume on both it "does the right thing", but wanted to make sure there weren't any hidden caveats before doing this.

Thanks,

Scott

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

From my experience, the answer to both questions is "yes". Note that the "purge" will actually involve running the coldToFrozenScript on the oldest buckets (in the oldest-to-newest order) until the index gets under it's maxTotalDataSizeMB.

View solution in original post

hexx
Splunk Employee
Splunk Employee

From my experience, the answer to both questions is "yes". Note that the "purge" will actually involve running the coldToFrozenScript on the oldest buckets (in the oldest-to-newest order) until the index gets under it's maxTotalDataSizeMB.

skippylou
Communicator

awesome, thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...