Can index compression be disabled once an index has already be created and is in use ?

[pierrem350]

Can we disable index compression in the /opt/splunk/etc/system/default/indexes.conf file once indexes are created ?

The indexes.conf documentation states that we cannot disable compression, why is that ?

compressRawdata = [true|false]

* This parameter is ignored. The splunkd process always compresses raw data."

Thank you!

[pierrem350]

Hi,

We're currently using Splunk on Solaris with ZFS as the underlying filesystem. As you may know, ZFS offers filesystem base compression and we can also choose between different compression algorythms..

Since it usually is a bad idea to try to compress data twice, I was looking for a way to disable Splunk's index compression so I can validate if there are gains to be made by using ZFS compression.

This being said, I also think it could be useful for people using NAS solutions that are based on ZFS (Sun's ZFS appliance, Nexenta's solutions, SGI's nas, etc). This would let the storage device deals with compression and leave as much cpu as possible for the indexer.

[adamw]

This used to be an option in the 3.0 days, but is no longer available, as it was not deemed to be useful. What is your use case for it?

[MHibbin]

Why do you not want to compress the raw data after Splunk has done it's stuff? - I'm sure if you give more details on your justification, some Splunker here can help some more possibly with an alternative