Getting Data In

Reduce size of index after amount of time

gpareesi11
Path Finder

Hi,
I'm currently looking if it possible to reduce the amount of data store in index after 6 months.

Example:
I'm collecting CPU performance metric at each second for my server, after 6 months is it possible to reduce the size by keeping only CPU performance metric on 5 minutes interval for the next 6 months ?

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Once data is indexed it cannot be deleted until the whole bucket ages out. There is a delete command, but it hides data rather than remove it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gpareesi11
Path Finder

I understand this part, but when the bucket ages out, I don't need to delete everything but keep a different log interval to reduce the amount of data kept on storage.

I still need some dashboard and report but based on 5 minutes log interval instead of 1 second ?

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider a summary index. Sample your 6-month-old data at 5-minute intervals and write it to a summary index with its own 6-month lifespan.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gpareesi11
Path Finder

Great thanks

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...