Hi all,
We are currently facing a space crunch in one of the search heads (6.2.1 v) running in VMware, total file system size /opt is 133GB out of which 89GB is consumed by account_summarydb, audit, and _internal under this path /opt/splunk/var/lib/splunk. So kindly guide us with a solution that can control the size from further growing.
df -h /opt
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_search01-opt_vol
133G 103G 24G 82% /opt
thanks in advance
Splunk recommends that you don't store any data in Search Head but forwarder all data to Indexers. Read below link for reason/benefits of doing so and process of setting up the same. This will resolve your spacing issue.
http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/Forwardsearchheaddata