Any way to reduce the storage footprint of a Windows LWF in 4.0?

[dskillman]

I've reduced the log retention timeout so that the disk footprint doesn't grow. Is there any way to remove anything from a 4.0 LWF-only install to reduce the on disk footprint?

[gkanapathy · Accepted solution]

The biggest thing you can do is reduce the size of the internal built-in indexes, particularly the _internal db. You can also edit log.cfg to reduce the number and size of retained text log files. splunkd.log, splunkd_access.log, metrics.log are allowed up to 150 mb each, for example.

I suppose you could delete all the *.pyc and *.pyo files under the Python2.6 directory. They would be regenerated as needed, but without SplunkWeb running, there might not be as many of them needed, and there might be some extraneous ones anyway. I'd say to use find . -name *.pyo -o -name *.pyc | xargs rm -f but Windows. Looks like that will save you, oh, maybe 4 or 8 MB. Pretty much nothing else large that you can afford to delete.

[jrodman]

A LWF doesn't have an _internal index, gk.

You could probably delete various binaries that are used for testing purposes and so on, but who knows when you'll want them again, and they'll come back on upgrade. You could erase the code that creates the webui, and so on...

But all of that is just going to make a huge unmaintainable mess.

Disk isn't that expensive. Tell engineering what you want to see in a future truly tiny forwarder.