
Optimize indexes
While the indexer is indexing data, one or more instances of the splunk-optimize
process will run intermittently, merging index files together to optimize performance when searching the data. The splunk-optimize
process can use a significant amount of cpu but only briefly. You can reduce the number of concurrent instances of splunk-optimize
by changing the value of maxConcurrentOptimizes
in indexes.conf
, but this is not typically necessary.
If splunk-optimize
does not run frequently enough, searching will be less efficient.
splunk-optimize
runs only on hot buckets. You can run it on warm buckets manually, if you find one with a larger number of index (.tsidx
) files; typically, more than 25. To run splunk-optimize
, go to $SPLUNKHOME/bin
and type:
splunk-optimize -d|--directory <bucket_directory>
splunk-optimize
accepts a number of optional parameters. To see a list of available parameters, type:
splunk-optimize
For more information on buckets, see How Splunk stores indexes.
PREVIOUS Manage pipeline sets for index parallelization |
NEXT Use the monitoring console to view indexing performance |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10
Feedback submitted, thanks!