Storage optimization

Splunk 6.4 introduced the new tsidx Retention Policy feature, which allows users to reduce the storage requirements of data available in the cold bucket. The tsidx files are stored under indexers and are responsible for efficient searching in Splunk. Basically, the space taken by historical data available in the cold bucket can be reduced by approximately 50 percent by removing the tsidx indexing information. This can help in saving a lot of money every year that is spent on the storage of old/historical data. This policy can be modified by navigating in the Splunk web interface to Settings | Indexes in Splunk 6.4.