internal index is huge

[Rajasekhar89]

indexing rate per index for one of the index is abnormal, last 1-week _internal index vs others metric logs has a huge ratio difference. can u tell what will be a possible solution for this, the Same question I just asked from my another account, u can reply to this I'd suggest me how to try?

[richgalloway]

The _internal index logs the activities that Splunk performs as well as the actions of the users. On a busy system, this can easily be a lot of data. Fortunately, _internal does not count toward your license so you only pay for the storage. If storage is a problem, consider changing the retention period from the default of 30 days to a smaller value, like 14 days. Be aware that doing so may affect some searches like the 30-day license usage report.