changing the size of an index

[a212830]

Hi,

I need to change the size of an index, as it's eating up to much space. Is it as simple as changing it's max size in the gui? Other than losing data, are there any other repurcussions? Do I need to reboot splunk?

[highsplunker]

hi,

i think i can give an answer for one indexer, i.e. non-clustered (as i don't see the answer here).

a. for TCP inputs: just resize (up\down) the max volume (and you will not lose date and the size will be changed)

b. for dbinputs:

* resize up = just change max size to lager value

* resize down = CAUTION (since you can lose all data in case you do it the wrong way)

step 1:  stop dbinput

step 2:  change max index size to a lesser value

step 3:  refresh the indexer via UI (.../debug/refresh)

step 4 (optional): check that you didn't lose your data

step 5: enable back you dbinput, and check your data again

[sbrant_splunk]

Be careful of changing the settings via the GUI if you are utilizing deployment server in your environment.

[DaveSavage]

Others have asked this question before. See Splunkbase: http://splunk-base.splunk.com/answers/10135/reduce-an-index-size