How can I shrink or truncate the data in splunk insight for infrastructure?
Just configure the volume
definitions in your indexes.conf
on your indexers
and constrain it to be within the maximum size that you can allow and Splunk will automatically delete the oldest events to make room for newer events as necessary.
@woodcock I created these files as they were not there, and restarted. No affect seen:
```
/opt/splunk/etc/system/local/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunk_app_infrastructure/default/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunk_app_infrastructure/local/indexes.conf:maxVolumeDataSizeMB = 10480
```
You also need to know the stanza header
that is immediately above each setting. Is it [default]
, or [yourIndexValue]
or [someIndexThatIsNotYours]
?
Not sure. Is it a single tar installation, and standalone installation. This is not an installation of app in splunk enterprise.
https://docs.splunk.com/Documentation/Infrastructure/1.4.0/Install/InstallOnLinux
You can use cribl
(https://cribl.io) to trim it on the way in. There are many, many ways, depending on what you mean. Tell the cribl guys that woodcock
sent you!
Not during the ingest. But truncate or cleanup whatever has been collected; logs and metrics data. We have small infrastructure and not much of disks to store all those SII data.
It depends on you are doing it. Are you using collectd
or what?
Yes, it uses collectd. SII by default (or probably only way) uses collectd.