Splunk IT Service Intelligence

Shrink data in splunk insight for infrastructure

Explorer

How can I shrink or truncate the data in splunk insight for infrastructure?

0 Karma

Esteemed Legend

Just configure the volume definitions in your indexes.conf on your indexers and constrain it to be within the maximum size that you can allow and Splunk will automatically delete the oldest events to make room for newer events as necessary.

Explorer

@woodcock I created these files as they were not there, and restarted. No affect seen:
```

grep maxVolumeDataSizeMB -R /opt/splunk/etc | grep -v README

/opt/splunk/etc/system/local/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunkappinfrastructure/default/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunkappinfrastructure/local/indexes.conf:maxVolumeDataSizeMB = 10480
```

0 Karma

Esteemed Legend

You also need to know the stanza header that is immediately above each setting. Is it [default], or [yourIndexValue] or [someIndexThatIsNotYours]?

0 Karma

Explorer

Not sure. Is it a single tar installation, and standalone installation. This is not an installation of app in splunk enterprise.
https://docs.splunk.com/Documentation/Infrastructure/1.4.0/Install/InstallOnLinux

0 Karma

Esteemed Legend

You can use cribl (https://cribl.io) to trim it on the way in. There are many, many ways, depending on what you mean. Tell the cribl guys that woodcock sent you!

0 Karma

Explorer

Not during the ingest. But truncate or cleanup whatever has been collected; logs and metrics data. We have small infrastructure and not much of disks to store all those SII data.

0 Karma

Esteemed Legend

It depends on you are doing it. Are you using collectd or what?

0 Karma

Explorer

Yes, it uses collectd. SII by default (or probably only way) uses collectd.

0 Karma