Monitoring Splunk

What is the performance impact of reducing maxTotalDataSizeMB?

New Member

Hi,

I plan to reduce the maxTotalDataSizeMB of several indices and would like to know the impact on performance of Splunk / System.
E.g. Will there be considerable slowness, etc.? What are other considerations when doing this change?

One index has size is 267GB and would be setting the maxTotalDataSizeMB from the default (500GB) to 80GB.

Thanks.

0 Karma
1 Solution

Influencer

You'll see a lot of I/O activity, but I have not seen this hugely impact performance of a Splunk system. Try to do one index at a time (with a few hours or a day in between) instead of all at once to limit any performance impact if you're concerned about it though.

View solution in original post

Influencer

You'll see a lot of I/O activity, but I have not seen this hugely impact performance of a Splunk system. Try to do one index at a time (with a few hours or a day in between) instead of all at once to limit any performance impact if you're concerned about it though.

View solution in original post

SplunkTrust
SplunkTrust

Yes, I second this. While it does depend on your disk, I've done this several times for various reasons (usually poor planning on my part) and never had any noticable impact. It only takes a few seconds after restart and it's finished. Yes, I'm using SSDs under Splunk, but really, it basically is just deleting a few files from the file system. Pretty quick.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!