Deployment Architecture

Disk space issue in indexer

Kaushikkatta03
Explorer

I ran out of disk space in one of the indexer its total size is 5Tb ,at present the size 4.9Tb

inside the "splogs" these are the directories which are consuming more space
208G syslogs
402G unix_bsm
173G unix_ldap
249G webops_appcd
278G win_svrs
290G net_proxy
494G summarydb

So can we delete the data inside it ? if so we delete will there be any impact as they are other 3 indexers in the environment along with this current one ? rest all indexers are doing good .

how to find master node and slave node !

Tags (1)
0 Karma
1 Solution

ddrillic
Ultra Champion

Good information at - How to free up disk space?

chanfoli says there -

-- You can safely delete cold and warm buckets with splunk stopped, understanding that you will loose the data contained in any deleted bucket. If you set your aging/size policies appropriately, splunk should roll to frozen (which by default, actually means delete) at some point soon after this config is picked up, but I have always handled such cases by deleting cold buckets.

View solution in original post

0 Karma

ddrillic
Ultra Champion

Good information at - How to free up disk space?

chanfoli says there -

-- You can safely delete cold and warm buckets with splunk stopped, understanding that you will loose the data contained in any deleted bucket. If you set your aging/size policies appropriately, splunk should roll to frozen (which by default, actually means delete) at some point soon after this config is picked up, but I have always handled such cases by deleting cold buckets.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...