Here are some techniques to reduce the size of the diag : If you do, please always mention in the case that files are missing from the diag. Check if they are no dump or core files in $SPLUNK_HOME/var/log/splunk/*.dmp If this is the case, move them out of the folder before generating the diag, and upload separately the last one only. If on the indexers the biggest file are your metadata (hosts.meta, sources.meta, sourcetype.meta etc...), then you may have a issue with performance (the SOS app warning dashboard will tell you). You can exclude them from the diag, and upload them separately example splunk diag --exlude *.data see http://docs.splunk.com/Documentation/Splunk/4.3.2/Troubleshooting/ContactSplunkSupport ... View more