How do I reduce an index size in a way so that I can delete older data from the index to make the size of the index come down?
how can this be done ? or recommendations ...
@jiaqya, two major config parameters control the size of an index - frozenTimePeriodInSecs
with a default of 6 years!! and maxTotalDataSizeMB
with a default of 1/2 TB. You can reduce either one of them.
You can save disk by deleting old data.
Please refer to the following URL.
http://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Setaretirementandarchivingpolicy
What does frozenTimePeriodInSecs do ?
does it help expire older data from the index + reduce index size ?
hi @jiaqya
Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!