topic Why is different tsidx file's size in same index? in Getting Data In

topic Why is different tsidx file's size in same index? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-is-different-tsidx-file-s-size-in-same-index/m-p/678035#M113317 <P>Hi.</P><P>I'm working on splunk operations team.</P><P>version: Enterprise 7.3.4, centos7</P><P>Environment : 3 SH, 10 IDX cluster.</P><P>Search Factor : 3</P><P>Replication Factor : 3</P><P> </P><P>Why is different tsidx file's size in same index?</P><P>My situation :</P><P>Tsidx file's  size in one specific indexer is 2~3x larger than size in the rest indexer.</P><P>So, this indexer storage sometimes goes to above 97% and indexing stops. After splunk instance restart, for a few days storage remains at 86~87%. (the rest indexers always remain at 86%)</P><P>I checked rawdata file's size. But, size is only affected by event count.</P><P>Not all indexes are included. 10 of 100 indexes are included.</P><P>I can't find cause. Help me.</P><P>If you need additional information, please let me know.</P><P><BR />Thank you.</P><P> </P> Tue, 20 Feb 2024 02:23:26 GMT dongwonn 2024-02-20T02:23:26Z Why is different tsidx file's size in same index? https://community.splunk.com/t5/Getting-Data-In/Why-is-different-tsidx-file-s-size-in-same-index/m-p/678035#M113317 <P>Hi.</P><P>I'm working on splunk operations team.</P><P>version: Enterprise 7.3.4, centos7</P><P>Environment : 3 SH, 10 IDX cluster.</P><P>Search Factor : 3</P><P>Replication Factor : 3</P><P> </P><P>Why is different tsidx file's size in same index?</P><P>My situation :</P><P>Tsidx file's  size in one specific indexer is 2~3x larger than size in the rest indexer.</P><P>So, this indexer storage sometimes goes to above 97% and indexing stops. After splunk instance restart, for a few days storage remains at 86~87%. (the rest indexers always remain at 86%)</P><P>I checked rawdata file's size. But, size is only affected by event count.</P><P>Not all indexes are included. 10 of 100 indexes are included.</P><P>I can't find cause. Help me.</P><P>If you need additional information, please let me know.</P><P><BR />Thank you.</P><P> </P> Tue, 20 Feb 2024 02:23:26 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-different-tsidx-file-s-size-in-same-index/m-p/678035#M113317 dongwonn 2024-02-20T02:23:26Z