How to dynamically shrink hot/warm index size?

Getting Data In

Hello,

Presently my hot/warm index occupies 50GB on disk (there are no limits specified in indexes.conf). I'd like to move it to a faster volume of 10GB size. What would be the correct steps to achieve this? For example:

- specify maxDataSizeMB = 10000
- restart splunk (will it shrink the hot index and move the rest of it to the cold path)?
- add new volume, manually move hot index files to new location

Thanks
Andrei

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...