Getting Data In

Is it safe to modify maxTotalDataSizeMB in a clustered environment (indexes.conf)?

splunkreal
Motivator

Hello,

maxTotalDataSizeMB of one index is too large, is it possible to reduce it (above current size of course), without any problem?

Thanks.

* If this helps, please upvote or accept solution 🙂 *

esix_splunk
Splunk Employee
Splunk Employee

This needs to be changed on the Cluster Master Node, under the $splunk_home$/etc/master-apps/ structure, and then deployed to your cluster.

Adding this on your individual indexers will cause problems and should not be done.

ddrillic
Ultra Champion

It should be just fine.

How can I change index size in cluster ?

@ChrisG says -

alt text

The link to @chrisG seems to be broken...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...