Shrink data in splunk insight for infrastructure

[rako1980]

How can I shrink or truncate the data in splunk insight for infrastructure?

[woodcock]

Just configure the volume definitions in your indexes.conf on your indexers and constrain it to be within the maximum size that you can allow and Splunk will automatically delete the oldest events to make room for newer events as necessary.

[rako1980]

@woodcock I created these files as they were not there, and restarted. No affect seen:
```

grep maxVolumeDataSizeMB -R /opt/splunk/etc | grep -v README

/opt/splunk/etc/system/local/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunk_app_infrastructure/default/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunk_app_infrastructure/local/indexes.conf:maxVolumeDataSizeMB = 10480
```

[woodcock]

You also need to know the stanza header that is immediately above each setting. Is it [default], or [yourIndexValue] or [someIndexThatIsNotYours]?

[rako1980]

Not sure. Is it a single tar installation, and standalone installation. This is not an installation of app in splunk enterprise.
https://docs.splunk.com/Documentation/Infrastructure/1.4.0/Install/InstallOnLinux

[woodcock]

You can use cribl (https://cribl.io) to trim it on the way in. There are many, many ways, depending on what you mean. Tell the cribl guys that woodcock sent you!

[rako1980]

Not during the ingest. But truncate or cleanup whatever has been collected; logs and metrics data. We have small infrastructure and not much of disks to store all those SII data.

[woodcock]

It depends on you are doing it. Are you using collectd or what?

[rako1980]

Yes, it uses collectd. SII by default (or probably only way) uses collectd.