Deployment Architecture

Any way to reduce the storage footprint of a Windows LWF in 4.0?

Splunk Employee
Splunk Employee

I've reduced the log retention timeout so that the disk footprint doesn't grow. Is there any way to remove anything from a 4.0 LWF-only install to reduce the on disk footprint?

1 Solution

Splunk Employee
Splunk Employee

The biggest thing you can do is reduce the size of the internal built-in indexes, particularly the _internal db. You can also edit log.cfg to reduce the number and size of retained text log files. splunkd.log, splunkd_access.log, metrics.log are allowed up to 150 mb each, for example.

I suppose you could delete all the *.pyc and *.pyo files under the Python2.6 directory. They would be regenerated as needed, but without SplunkWeb running, there might not be as many of them needed, and there might be some extraneous ones anyway. I'd say to use find . -name *.pyo -o -name *.pyc | xargs rm -f but Windows. Looks like that will save you, oh, maybe 4 or 8 MB. Pretty much nothing else large that you can afford to delete.

View solution in original post

Splunk Employee
Splunk Employee

The biggest thing you can do is reduce the size of the internal built-in indexes, particularly the _internal db. You can also edit log.cfg to reduce the number and size of retained text log files. splunkd.log, splunkd_access.log, metrics.log are allowed up to 150 mb each, for example.

I suppose you could delete all the *.pyc and *.pyo files under the Python2.6 directory. They would be regenerated as needed, but without SplunkWeb running, there might not be as many of them needed, and there might be some extraneous ones anyway. I'd say to use find . -name *.pyo -o -name *.pyc | xargs rm -f but Windows. Looks like that will save you, oh, maybe 4 or 8 MB. Pretty much nothing else large that you can afford to delete.

View solution in original post

Splunk Employee
Splunk Employee

A LWF doesn't have an _internal index, gk.

You could probably delete various binaries that are used for testing purposes and so on, but who knows when you'll want them again, and they'll come back on upgrade. You could erase the code that creates the webui, and so on...

But all of that is just going to make a huge unmaintainable mess.

Disk isn't that expensive. Tell engineering what you want to see in a future truly tiny forwarder.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!