Splunk Search

Lacking Diskspace on /Splunkidx

thiliphk
New Member

How do we determine the need for increasing diskspace on /Splunkidx. Do we have any formula ?

Tags (4)
0 Karma

yannK
Splunk Employee
Splunk Employee

The amount of disk space needed for the indexes= sum of all the maxTotalDataSizeMB of all the indexes + 2GB safety.

If you are using the Volume option, read this http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstoragesize

If you are splitting the indexes homePath and ColPath in different partitions, see this http://wiki.splunk.com/Deploy:BucketRotationAndRetention
and http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Usemultiplepartitionsforindexdata

the formula for the space used by one index on each location is :

homePath total size =(maxWarmDBCount + maxHotBuckets ) * maxDataSize

coldPath total size = maxTotalDataSizeMB - "size of the hot+warm+cold buckets"

If you also have $SPLUNK_HOME on the same partition, do not forget to account for the dispatch folder (depends of the roles, usually 100MB per user + 500MB per power user + 10000MB per admin) (see authorize.conf)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...