Monitoring Splunk

Splunk Diskspace Usage

Mkbell35
Engager

How do we manage the diskspace usage by splunk.

  1. Does it get truncate at x number of days?
  2. Do we need to setup an alert the monitor the splunk logs too?

[Converted to question from answer on this question]

1 Solution

Drainy
Champion

This docs post explains it all pretty well;
http://docs.splunk.com/Documentation/Splunk/latest/admin/Setaretirementandarchivingpolicy

Essentially Splunk stores data in hot, warm and cold buckets and then eventually turns to a frozen state. You can define the time between these changes in seconds or size of the buckets. Frozen is a state where you can either choose to run a script to archive and move your oldest data, perhaps to external storage, or (by default) just have it deleted. This way you can configure your data to age out after a certain period of time.

You can set up alerts to monitor Splunk logs too if you really want, the alerting is only available in the trial Enterprise license or on a fully licensed Enterprise system. There is also an app called SoS which is available here that can help you monitor and analyse Splunk problems or errors. Bundled with Splunk is an app called the deployment monitor that you can also activate to help monitor your license usage.

Have a read of the link and pop back if you find you have any specific questions.

View solution in original post

Drainy
Champion

This docs post explains it all pretty well;
http://docs.splunk.com/Documentation/Splunk/latest/admin/Setaretirementandarchivingpolicy

Essentially Splunk stores data in hot, warm and cold buckets and then eventually turns to a frozen state. You can define the time between these changes in seconds or size of the buckets. Frozen is a state where you can either choose to run a script to archive and move your oldest data, perhaps to external storage, or (by default) just have it deleted. This way you can configure your data to age out after a certain period of time.

You can set up alerts to monitor Splunk logs too if you really want, the alerting is only available in the trial Enterprise license or on a fully licensed Enterprise system. There is also an app called SoS which is available here that can help you monitor and analyse Splunk problems or errors. Bundled with Splunk is an app called the deployment monitor that you can also activate to help monitor your license usage.

Have a read of the link and pop back if you find you have any specific questions.

Mkbell35
Engager

Thanks so much for your help well explained and to your offers.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...