The indexes almost consumed the entire terabyte of space allocated for them. What would be a simple way to clear some space?
The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here.
http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy
The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here.
http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy
You are absolutely right -
We see -
234G _internaldb
14G _introspection
Can we handle them like any other index?
Yes, the indexes.conf for these internal indexes will available in $SPLUNK_HOME/etc/system/default
. DO NOT UPDATE that copy. Instead create an indexes.conf in $SPLUNK_HOME/etc/system/local
OR any app to update the stanza for _internal
and _introspection
indexes.
Makes perfect sense - much appreciated.