What is the performance impact of reducing maxTotalDataSizeMB?

[emontano]

Hi,

I plan to reduce the maxTotalDataSizeMB of several indices and would like to know the impact on performance of Splunk / System.
E.g. Will there be considerable slowness, etc.? What are other considerations when doing this change?

One index has size is 267GB and would be setting the maxTotalDataSizeMB from the default (500GB) to 80GB.

Thanks.

[masonmorales · Accepted solution]

You'll see a lot of I/O activity, but I have not seen this hugely impact performance of a Splunk system. Try to do one index at a time (with a few hours or a day in between) instead of all at once to limit any performance impact if you're concerned about it though.

[Richfez]

Yes, I second this. While it does depend on your disk, I've done this several times for various reasons (usually poor planning on my part) and never had any noticable impact. It only takes a few seconds after restart and it's finished. Yes, I'm using SSDs under Splunk, but really, it basically is just deleting a few files from the file system. Pretty quick.