How to dynamically shrink hot/warm index size?

Getting Data In

Hello,

Presently my hot/warm index occupies 50GB on disk (there are no limits specified in indexes.conf). I'd like to move it to a faster volume of 10GB size. What would be the correct steps to achieve this? For example:

- specify maxDataSizeMB = 10000
- restart splunk (will it shrink the hot index and move the rest of it to the cold path)?
- add new volume, manually move hot index files to new location

Thanks
Andrei

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

Thursday, July 9, 2026 | 11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...