Splunk Search

Lacking Diskspace on /Splunkidx

thiliphk
New Member

How do we determine the need for increasing diskspace on /Splunkidx. Do we have any formula ?

Tags (4)
0 Karma

yannK
Splunk Employee
Splunk Employee

The amount of disk space needed for the indexes= sum of all the maxTotalDataSizeMB of all the indexes + 2GB safety.

If you are using the Volume option, read this http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstoragesize

If you are splitting the indexes homePath and ColPath in different partitions, see this http://wiki.splunk.com/Deploy:BucketRotationAndRetention
and http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Usemultiplepartitionsforindexdata

the formula for the space used by one index on each location is :

homePath total size =(maxWarmDBCount + maxHotBuckets ) * maxDataSize

coldPath total size = maxTotalDataSizeMB - "size of the hot+warm+cold buckets"

If you also have $SPLUNK_HOME on the same partition, do not forget to account for the dispatch folder (depends of the roles, usually 100MB per user + 500MB per power user + 10000MB per admin) (see authorize.conf)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...