Monitoring Splunk

Are there maintenance steps or best practices around managing the size of the defaultdb folder?

jrubio1
New Member

Hello everyone,

I'm fairly new to Splunk and currently have the issue where the Splunk server is above 93% disk utilization due to the splunk defaultdb folder. My question is: Is there some maintenance steps or best practice items for managing the size?

alt text

0 Karma

lguinn2
Legend

Yes, there are best practices, but that is a pretty general question. You should start by understanding how Splunk stores indexes and how to configure them in general.

But since you may be in a disk space crisis, I would first examine the maximum size of the main index (that is what is stored in defaultdb). I would make sure that maximum size is not going to allow the index to grow any larger. All of this can be done from the Splunk GUI under Settings.

Take a look at the documentation here: Manage Index Storage

You have many choices in configuring indexes, including both size and location of the various components. If this post doesn't answer your question, then please refine the question. What do you want to do? Make the index smaller, move it to a different disk drive, split it between drives, set a retention policy to remove older data, etc. Then the community can give you better advice.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...