Deployment Architecture

Any Risk if increased/decreased index data size

ips_mandar
Builder

Hi,
I have created one index of size 500GB(maxTotalDataSizeMb) and also included frozen path where data will get stored after 500Gb data gets completed. Now I want to know below-
1. If I Increased size of that index to 1TB then is there any risk involved of data gets deleted?
2. After changing to 1TB If I consider to reduce data size to 800 Gb then remaining 200Gb data will go to frozen path? is there any risk involved/any precaution neeeds to be taken to avoid data loss?
3. If I want to move frozen bucket to be searchable then I copied particular frozen bucket to thawed path and then after data retention those buckets moved to frozen path then will I have duplicate buckets? so I need to move frozen bucket to thawed path instead of copying it?
thanks,

0 Karma

richgalloway
SplunkTrust
SplunkTrust
  1. Increasing the size of an index does not result in data getting deleted.
  2. Since you have a frozen path, data will not be deleted. It will be moved to the frozen directory.
  3. Thawed data is not managed by Splunk so it will not be re-frozen. It will not be replicated or duplicated. When the thawed data is not longer needed, it must be removed manually.
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...