How do we manage the diskspace usage by splunk.
[Converted to question from answer on this question]
This docs post explains it all pretty well;
http://docs.splunk.com/Documentation/Splunk/latest/admin/Setaretirementandarchivingpolicy
Essentially Splunk stores data in hot, warm and cold buckets and then eventually turns to a frozen state. You can define the time between these changes in seconds or size of the buckets. Frozen is a state where you can either choose to run a script to archive and move your oldest data, perhaps to external storage, or (by default) just have it deleted. This way you can configure your data to age out after a certain period of time.
You can set up alerts to monitor Splunk logs too if you really want, the alerting is only available in the trial Enterprise license or on a fully licensed Enterprise system. There is also an app called SoS which is available here that can help you monitor and analyse Splunk problems or errors. Bundled with Splunk is an app called the deployment monitor that you can also activate to help monitor your license usage.
Have a read of the link and pop back if you find you have any specific questions.
This docs post explains it all pretty well;
http://docs.splunk.com/Documentation/Splunk/latest/admin/Setaretirementandarchivingpolicy
Essentially Splunk stores data in hot, warm and cold buckets and then eventually turns to a frozen state. You can define the time between these changes in seconds or size of the buckets. Frozen is a state where you can either choose to run a script to archive and move your oldest data, perhaps to external storage, or (by default) just have it deleted. This way you can configure your data to age out after a certain period of time.
You can set up alerts to monitor Splunk logs too if you really want, the alerting is only available in the trial Enterprise license or on a fully licensed Enterprise system. There is also an app called SoS which is available here that can help you monitor and analyse Splunk problems or errors. Bundled with Splunk is an app called the deployment monitor that you can also activate to help monitor your license usage.
Have a read of the link and pop back if you find you have any specific questions.
Thanks so much for your help well explained and to your offers.