Getting Data In

Reduce size of index after amount of time

gpareesi11
Path Finder

Hi,
I'm currently looking if it possible to reduce the amount of data store in index after 6 months.

Example:
I'm collecting CPU performance metric at each second for my server, after 6 months is it possible to reduce the size by keeping only CPU performance metric on 5 minutes interval for the next 6 months ?

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Once data is indexed it cannot be deleted until the whole bucket ages out. There is a delete command, but it hides data rather than remove it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gpareesi11
Path Finder

I understand this part, but when the bucket ages out, I don't need to delete everything but keep a different log interval to reduce the amount of data kept on storage.

I still need some dashboard and report but based on 5 minutes log interval instead of 1 second ?

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider a summary index. Sample your 6-month-old data at 5-minute intervals and write it to a summary index with its own 6-month lifespan.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gpareesi11
Path Finder

Great thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...