Back to the Blog

Trimming Down your Splunk Indexer Storage with TSIDX Retention Settings

Posted by Anshu Rastogi on Thursday, August 4, 2016 - 10:46 Operational Intelligence Splunk 6.4, Splunk, tsidx, retention, storage, indexer, lexicon, bucket, rebuild, Audit

Hi everyone.  Today I wanted to cover the tsidx retention feature that was released in Splunk version 6.4.  This feature helps you reduce the storage costs for your indexer while maintaining actively searchable data.  Also in this blog, I wanted to try a new format and convey the information in an FAQ style.  Please leave a comment if you found the new format helpful for learning about tsidx retention.

Tsidx File Fundamentals

First let's cover some fundamentals about tsidx files.

Q. What is a tsidx file?
A. Tsidx stands for "time-series index" file.  It's...

read more

Think small, search faster

Posted by Ridwan Ahmed on Monday, August 19, 2013 - 15:03 Operational Intelligence search, speed, Splunk, tsidx

Compared to a few years ago, it is almost unbelievable that we are able to sift the amount of data we can, and the speed with which we can do it. But like the fast cars we drive today that are much faster than similar cars of yesteryear, we get used to the speed we have, and soon wonder: “can it go faster?”

Yes, but with some conditions.

Like Turbocharging, Supercharging, and enlarging the displacement in cars-- all valid ways to make a fast car go faster, --in Splunk there is Report Acceleration, Summary Indexing, and searching tsidx files.  Each has its own benefits and...

read more
Stay In Touch