Deployment Architecture

Any way to reduce the storage footprint of a Windows LWF in 4.0?

dskillman
Splunk Employee
Splunk Employee

I've reduced the log retention timeout so that the disk footprint doesn't grow. Is there any way to remove anything from a 4.0 LWF-only install to reduce the on disk footprint?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The biggest thing you can do is reduce the size of the internal built-in indexes, particularly the _internal db. You can also edit log.cfg to reduce the number and size of retained text log files. splunkd.log, splunkd_access.log, metrics.log are allowed up to 150 mb each, for example.

I suppose you could delete all the *.pyc and *.pyo files under the Python2.6 directory. They would be regenerated as needed, but without SplunkWeb running, there might not be as many of them needed, and there might be some extraneous ones anyway. I'd say to use find . -name *.pyo -o -name *.pyc | xargs rm -f but Windows. Looks like that will save you, oh, maybe 4 or 8 MB. Pretty much nothing else large that you can afford to delete.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The biggest thing you can do is reduce the size of the internal built-in indexes, particularly the _internal db. You can also edit log.cfg to reduce the number and size of retained text log files. splunkd.log, splunkd_access.log, metrics.log are allowed up to 150 mb each, for example.

I suppose you could delete all the *.pyc and *.pyo files under the Python2.6 directory. They would be regenerated as needed, but without SplunkWeb running, there might not be as many of them needed, and there might be some extraneous ones anyway. I'd say to use find . -name *.pyo -o -name *.pyc | xargs rm -f but Windows. Looks like that will save you, oh, maybe 4 or 8 MB. Pretty much nothing else large that you can afford to delete.

jrodman
Splunk Employee
Splunk Employee

A LWF doesn't have an _internal index, gk.

You could probably delete various binaries that are used for testing purposes and so on, but who knows when you'll want them again, and they'll come back on upgrade. You could erase the code that creates the webui, and so on...

But all of that is just going to make a huge unmaintainable mess.

Disk isn't that expensive. Tell engineering what you want to see in a future truly tiny forwarder.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...