Documentation > Splunk > Admin Manual > Reduce indexing density

Admin Manual

 


Overview
Setting Up Data Inputs
Authentication
Changing the Way Splunk Processes Your Data
Creating and Using Configuration Bundles
Configuring Your Sources
Splunk-2-Splunk Management
Integration
Managing Your Filesystem
How-To's

Reduce indexing density

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Reduce indexing density

Another way to increase indexing performance is to disable the parsing of minor segments and only index major segments - for example to index spaghetti.monster@support.splunk.com but not each separate part of the address. In this example, we'll reduce indexing density for sourcetype myApp.


The best way to create you own cleaners files is to copy either cleaners.xml or majorOnly_cleaners.xml and edit/remove entries as necessary.


These files are xml files that have the following format: 


/* sample breaking separator config */
                           <config>
                               <method>separator</method>
                               <fieldName>_raw</fieldName>
                               <trailingPrefix>trail_brk</trailingPrefix>
                                <breakingSeparators>
                                 <breakingSeparator name="lsqrBracketBreak" isMajor="1">
                                       <value>[</value>
                                 </breakingSeparator>
                                 <breakingSeparator  name="rsqrBracketBreak" isMajor="1">
                                       <value>]</value>
                                 </breakingSeparator>
                              <...>
                         </config>

At the top of the file the tag <defaultCleaningConfig> is used to specify if none are specified.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/2.2.3/Admin/ReduceIndexingDensity"

This documentation applies to the following versions of Splunk: 2.1 , 2.2 , 2.2.1 , 2.2.3 , 2.2.6 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.