Splunk Cloud Platform

DDAS

yashb
Engager

Hi All,

Our DDAS usage has increased to 119.2%. What are some effective ways or best practices to optimize and reduce the usage? Any guidance or recommendations would be appreciated.

Thanks in advance!

Labels (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @yashb 

DDAS usage is based on the raw ingestion volume x number of days it’s stored for  

Ultimately there are 2 ways to reduce your DDAS (Active Searchable Storage) in Splunk Cloud. 
The first approach is to reduce your retention where possible, are there any indexes that you are keeping data for longer than you require it? Often Dev/Test environments can end up using lots of storage due to unnecessarily long retentions or big events like load/soak testing - for example. 

The other approach is to filter out data you don’t need, or strip specific fields/strings from raw events which are not required. For example you could drop any occurrence of an event containing “DEBUG” unless it’s required, or route it into an index with shorter retention.  You can achieve this in a number of ways depending on your environment, such as applying props/transforms at parsing/index time, using Ingest Actions or using Ingest Processor. 
I won’t go into specific examples here but if you want more help with a specific approach please let me know and I can provide sample configurations. 

 

 

🌟 Did this answer help you? If so, please consider:

    • Adding karma to show it was helpful
    • Marking it as the solution if it resolved your issue
    • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...