Creating multiple indexes

[louieb3]

I just wanted to check to see how everyone goes about creating indexes. Right now, we seem to be creating a new index for each source that we ingest into splunk. So my question is - are we going about this wrong? Should we be putting more data in main? What are the pros and cons of creating separate indexes vs putting everything together in fewer indexes?

[lukejadamec · Accepted solution]

If you don't specify an index, then it can increase search time.

If you specify an index, it will reduce search time.

Splunk does not care how many indexes you have, but you might if you cannot easily specify the index that contains the data you're looking for.

[yannK]

Thousands of indexes is overkill 🙂
from a couple to a dozen of indexes is a good start. all depends of your volume.

Having several indexes is useful for :

• access control, with permissions role/index
• retention, to have different size/time retentions per index
• search performances, by searching on a specific index