https://community.splunk.com/t5/Deployment-Architecture/Disk-space-issue-in-indexer/m-p/225988#M23802 <P>I ran out of disk space in one of the indexer its total size is 5Tb ,at present the size 4.9Tb </P> <P>inside the "splogs" these are the directories which are consuming more space<BR /> 208G syslogs <BR /> 402G unix_bsm <BR /> 173G unix_ldap <BR /> 249G webops_appcd<BR /> 278G win_svrs <BR /> 290G net_proxy<BR /> 494G summarydb</P> <P>So can we delete the data inside it ? if so we delete will there be any impact as they are other 3 indexers in the environment along with this current one ? rest all indexers are doing good .</P> <P>how to find master node and slave node !</P> Tue, 29 Sep 2020 10:01:59 GMT Kaushikkatta03 2020-09-29T10:01:59Z https://community.splunk.com/t5/Deployment-Architecture/Disk-space-issue-in-indexer/m-p/225988#M23802 <P>I ran out of disk space in one of the indexer its total size is 5Tb ,at present the size 4.9Tb </P> <P>inside the "splogs" these are the directories which are consuming more space<BR /> 208G syslogs <BR /> 402G unix_bsm <BR /> 173G unix_ldap <BR /> 249G webops_appcd<BR /> 278G win_svrs <BR /> 290G net_proxy<BR /> 494G summarydb</P> <P>So can we delete the data inside it ? if so we delete will there be any impact as they are other 3 indexers in the environment along with this current one ? rest all indexers are doing good .</P> <P>how to find master node and slave node !</P> Tue, 29 Sep 2020 10:01:59 GMT https://community.splunk.com/t5/Deployment-Architecture/Disk-space-issue-in-indexer/m-p/225988#M23802 Kaushikkatta03 2020-09-29T10:01:59Z https://community.splunk.com/t5/Deployment-Architecture/Disk-space-issue-in-indexer/m-p/225989#M23803 <P>Good information at - <A href="https://answers.splunk.com/answers/210811/how-to-free-up-disk-space.html">How to free up disk space?</A></P> <P>chanfoli says there -</P> <P>-- You can safely delete cold and warm buckets with splunk stopped, understanding that you will loose the data contained in any deleted bucket. If you set your aging/size policies appropriately, splunk should roll to frozen (which by default, actually means delete) at some point soon after this config is picked up, but I have always handled such cases by deleting cold buckets.</P> Thu, 23 Jun 2016 14:39:24 GMT https://community.splunk.com/t5/Deployment-Architecture/Disk-space-issue-in-indexer/m-p/225989#M23803 ddrillic 2016-06-23T14:39:24Z