Reduce an index size

[skippylou]

Couldn't find exact clarification on a couple things regarding reducing an index size but assuming how I think it will work, hoping someone has the definitive answer out there.

If say I have an index that has a max size setting of 50g. Let's say this index is currently using 45g of it.

I now want to reduce the max size for that index to 30g. After restarting splunk will it:

1) Purge data to get under the 30g limit? (assuming also it would then remove older buckets as necessary to stay under that limit as new data comes in moving forward - much as my current indexes that have hit limits do).

2) Start purging the oldest buckets first?

I assume on both it "does the right thing", but wanted to make sure there weren't any hidden caveats before doing this.

Thanks,

Scott

[hexx · Accepted solution]

From my experience, the answer to both questions is "yes". Note that the "purge" will actually involve running the coldToFrozenScript on the oldest buckets (in the oldest-to-newest order) until the index gets under it's maxTotalDataSizeMB.

[skippylou]

awesome, thanks.