Getting Data In

How to limit the maximum indexing volume a day per index?

jrodriguezap
Contributor

Hello everyone
I am trying to limit the ability of indexing per day of for each of my indexes as follows:
indexA = 5GB
indexB = 3GB
indexC = 8GB

In my indexes.conf file I have the following:

[indexA]
maxDataSize = 5120
[indexB]
maxDataSize = 3072
[indexC]
maxDataSize = 8192

However, this amount exceeds indexing daily. Am I doing something wrong or am I missing something? I'm grateful for your help.

Regards
Jorge

0 Karma

satishsdange
Builder

Hi -
Here is definition of maxDataSize -

maxDataSize = <positive integer>|auto|auto_high_volume
    * The maximum size in MB for a hot DB to reach before a roll to warm is triggered.

Docs link - http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/Indexesconf

In case you want to limit indexing volume/day, you should ideally configure inputs.conf for the correct inputs or props.conf for event filtering.

0 Karma

jrodriguezap
Contributor

Thanks satishsdange
I understand the use of inputs and props. But that more than anything is to filter or manipulate the data to be indexed, which already have done.
The detail is that my indexB usually consume 2.8GB, but sometimes exceeds 3.9GB, and this affects me. As always wanted to reach a maximum of 3GB per day.
May be this?

0 Karma

satishsdange
Builder

Does it mean that you want to drop data after hot bucket reaches 3GB?

0 Karma

jrodriguezap
Contributor

yes.
Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...