Reducing Index Density
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Reducing Index Density
One way to increase indexing performance is to disable the parsing of minor segments and only index major segments - for example to index spaghetti.monster@support.splunk.com but not each separate part of the address. In this example, we'll reduce indexing density for sourcetype myApp.
Segmentation configurations are configurable through the segmenters.conf file. For more information on segmentation please review this topic.
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 View the Article History for its revisions.