Controlling data volumes

Controlling Data Volumes

In this topic we discuss different ways to control the type and quantity of data that you bring into Splunk for for VMware. Having control over your data is important as the amount you collect can directly affect your licensing requirements.

How to limit your data volume

Collecting the correct type of data is important, but so also is limiting the quantity of data that you bring into Splunk. We are always looking for ways to streamline our data collection process and only collect the data that's necessary. As a systems administrator you can limit your data volume by removing duplicate fields that are currently in the data. Due to changes we have made in the data formats the Min and Max fields are now duplicates of the Average field. This is not an issue for the views and dashboards that we provide you as part of the release we are backward compatible with previous versions.

Any customizations that you have made to the App (views, searches, dashboards) can be affected by this change and you may be collecting duplicate information using these "older" fields in your searches,

We recommend that you update your custom searches and custom views and that when you write new ones that you base them only on using the Average field as Min, Max, and Average have the same value. Removing min and max as duplicate fields reduces the amount of unnecessary data coming into Splunk.