Monitoring Splunk

What is a simple way to clear some space if I'm running out of disk space allocated for indexes?

ddrillic
Ultra Champion

The indexes almost consumed the entire terabyte of space allocated for them. What would be a simple way to clear some space?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here.

http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here.

http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy

ddrillic
Ultra Champion

You are absolutely right -

We see -

234G _internaldb
14G _introspection

Can we handle them like any other index?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Yes, the indexes.conf for these internal indexes will available in $SPLUNK_HOME/etc/system/default. DO NOT UPDATE that copy. Instead create an indexes.conf in $SPLUNK_HOME/etc/system/local OR any app to update the stanza for _internal and _introspection indexes.

0 Karma

ddrillic
Ultra Champion

Makes perfect sense - much appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...