I've read it's not recommended to build indexes with maxdatasize for buckets less than 750mb, but what about indexes that do not generate many events?

[xxyz]

I've read that it's not recommended to build indexes with maxdatasize for buckets less than 750mb. What about for small footprint indexes that do not generate a lot of events?

[hortonew]

Perfectly acceptable to lower this. Splunk provides an example of this on their indexes.conf page:

http://docs.splunk.com/Documentation/Splunk/6.2.4/admin/Indexesconf
maxDataSize = 500

The recommendations depend on your bucket rotation strategies (how many warm buckets you're keeping, where they're going afterwards, etc).