Getting Data In

Shrink or reduce indexer

Path Finder


I have been gathering data on an indexer for more than 2 years and though data has been useful but i think we can reduce the data to 1.5 yrs, is there is a way to shrink truncate indexers?

What are recommended ways to maintain life of data, i know ageing from hot to warl to cold buckets is something i have heard of not sure how it works (does splunk automatically take care of it or is something i need to do as admin?)

0 Karma



there are two ways to control the size of your indexes: size and time.

When you create or configer an index, you can give the index a maximum size (maxTotalDataSizeMB). Whenever this size is reached, events are frozen. This can be done via WebUI. The second option is to configure a time period, whenever all events are older than the time period, the events are frozen (frozenTimePeriodInSecs). If you have no action defined for the transition to frozen (for example a script) the events are deleted. You can find additional infos here: link.



0 Karma

Ultra Champion

And it might be worth to mention that since both of these settings have a default value, the discarding of data will be triggered by whichever of these limits gets hit first.

So if you want to use time as a limiting factor, ensure that you set the maxTotalDataSizeMB so high that you can be certain that frozenTimePeriodInSecs will trigger before the size constraint. And vice versa.


0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...