How can I reduce the storage size of an index, what are the different methods/options?

[foundationservi]

Hi,

How can I reduce the storage size of an index, what are the different methods/options?

Also, will removing logs using the delete command reduce the storage size of an index?

Kind Regards,

Aftab

[nordinethales]

Hello,

better way to reduce the size of index is to reduce retention period, or some other parameter of index configuration. You need splunk admin rights. Some info from the documentation:

Use these indexes.conf settings to configure data retention policies for a SmartStore index:

• maxGlobalDataSizeMB
• maxGlobalRawDataSizeMB
• frozenTimePeriodInSecs

I hope it helps you

Regards

[richgalloway]

The delete command doesn't actually delete anything.  It just marks events as hidden so they don't appear in search results so no storage is saved by that command.

The only way to reduce the space used by an index is to wait for Splunk to delete buckets as data ages or times out.  You can accelerate that by changing the retention settings of that index and restarting the indexer(s).

That said, if you are using datamodel acceleration then that will consume storage on your index volume.  That storage can be reduced by disabling DMA that is not used or by reducing the summary window for a DM.