Hello,
maxTotalDataSizeMB of one index is too large, is it possible to reduce it (above current size of course), without any problem?
Thanks.
This needs to be changed on the Cluster Master Node, under the $splunk_home$/etc/master-apps/ structure, and then deployed to your cluster.
Adding this on your individual indexers will cause problems and should not be done.
It should be just fine.
How can I change index size in cluster ?
@ChrisG says -
The link to @chrisG seems to be broken...