This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 2.1 , 2.2 , 2.2.1 , 2.2.3 , 2.2.6
The extreme form of reducing indexing density is to turn off segmentation altogether - the Splunk Server will only index each event's meta data - host, source and sourcetype.
For example, to turn of tokenization by sourcetype add the following to the bundle's inputs.conf file.
[tail://var/log/mylog] _isTokenized = true
All data indexed that is from source /var/log/mylog will not have any of the raw log data indexed. Only source, host, sourcetype and timestamps will be searchable.