Getting Data In

What are possible files to clear disk space in Splunk indexer?

RAYUDU_NARA
Explorer

Hi,

In my production environment we allocated disk space around 800GB but still it's not enough. It is eating lot of disk space. Can someone suggest what are the possible files we can clear in Splunk Indexer in Production Environment.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You have the raw data and the tsidx files that make up an index. Those tsidx files utilize quite a bit of storage (size is based on uniqueness of data). So you could always set tsidx reduction based on index which should give you ~30-50% reduction in disk space. But be warned, this will have a significant performance hit and should only be used on data that is rarely searched but must be retained

https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Reducetsidxdiskusage

adonio
Ultra Champion

add a cap to indexes size in indexes.conf
leverage the config:

maxTotalDataSizeMB = <nonnegative integer>
* The maximum size of an index (in MB).
* If an index grows larger than the maximum size, the oldest data is frozen.
* This parameter only applies to hot, warm, and cold buckets.  It does not
  apply to thawed buckets.
* Highest legal value is 4294967295
* Defaults to 500000.

read here more:
https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Indexesconf
also read this manual all the way through for capacity planing:
http://docs.splunk.com/Documentation/Splunk/6.6.3/Capacity/IntroductiontocapacityplanningforSplunkEn...
hope it helps

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...