How to dynamically shrink hot/warm index size?

Getting Data In

Hello,

Presently my hot/warm index occupies 50GB on disk (there are no limits specified in indexes.conf). I'd like to move it to a faster volume of 10GB size. What would be the correct steps to achieve this? For example:

- specify maxDataSizeMB = 10000
- restart splunk (will it shrink the hot index and move the rest of it to the cold path)?
- add new volume, manually move hot index files to new location

Thanks
Andrei

Get Updates on the Splunk Community!

Self-Healing Pipeline Is Now Generally Available: AI-Powered CIM Compliance

Maintaining data integrity across security and analytics pipelines is an ongoing challenge. Data ...

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without ...

Instrumentation is usually the last step or even an afterthought when building out a project. The feature ...

Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk ...

Federated Search for Cisco Security Analytics and Logging (SAL) is now generally available as part of the ...