How do you reduce an index size that's taking a lot of space?

[jiaqya]

How do I reduce an index size in a way so that I can delete older data from the index to make the size of the index come down?

how can this be done ? or recommendations ...

[ddrillic]

@jiaqya, two major config parameters control the size of an index - frozenTimePeriodInSecs with a default of 6 years!! and maxTotalDataSizeMB with a default of 1/2 TB. You can reduce either one of them.

[HiroshiSatoh]

You can save disk by deleting old data.
Please refer to the following URL.

http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Setaretirementandarchivingpolicy

[jiaqya]

What does frozenTimePeriodInSecs do ?
does it help expire older data from the index + reduce index size ?

[mstjohn_splunk]

hi @jiaqya

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!