https://community.splunk.com/t5/Getting-Data-In/What-is-the-expected-behavior-of-setting-maxTotalDataSizeMB-0/m-p/61863#M12361 <P>The documentation infers:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Indexesconf">http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Indexesconf</A></P> <P>maxTotalDataSizeMB = <INTEGER></INTEGER></P> <UL> <LI>The maximum size of an index (in MB). </LI> <LI>If an index grows larger than the maximum size, the oldest data is frozen.</LI> <LI>This paremeter only applies to hot, warm, and cold buckets. It does not apply to thawed buckets.</LI> <LI>Defaults to 500000.</LI> <LI>Highest legal value is 4294967295</LI> </UL> Mon, 17 Sep 2012 17:07:23 GMT the_wolverine 2012-09-17T17:07:23Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-expected-behavior-of-setting-maxTotalDataSizeMB-0/m-p/61863#M12361 <P>The documentation infers:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Indexesconf">http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Indexesconf</A></P> <P>maxTotalDataSizeMB = <INTEGER></INTEGER></P> <UL> <LI>The maximum size of an index (in MB). </LI> <LI>If an index grows larger than the maximum size, the oldest data is frozen.</LI> <LI>This paremeter only applies to hot, warm, and cold buckets. It does not apply to thawed buckets.</LI> <LI>Defaults to 500000.</LI> <LI>Highest legal value is 4294967295</LI> </UL> Mon, 17 Sep 2012 17:07:23 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-expected-behavior-of-setting-maxTotalDataSizeMB-0/m-p/61863#M12361 the_wolverine 2012-09-17T17:07:23Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-expected-behavior-of-setting-maxTotalDataSizeMB-0/m-p/61864#M12362 <P>The expected behavior for maxTotalDataSizeMB=0 is to use an unlimited size for the index.<BR /> However there is a <STRONG>known bug for splunk 4.3.1 to 4.3.2</STRONG> fixed in 4.3.3 that considered the <BR /> "0" value as a "zero" and shrinked the index.</P> <P>see : <A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/ReleaseNotes/Knownissues">http://docs.splunk.com/Documentation/Splunk/4.3.1/ReleaseNotes/Knownissues</A><BR /> and <A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/ReleaseNotes/4.3.3">http://docs.splunk.com/Documentation/Splunk/4.3.3/ReleaseNotes/4.3.3</A></P> <BLOCKQUOTE> <P>Setting maxTotalDataSizeMB = 0 causes the index to be deleted on restart (rather than allowing infinite index size, which is what one would expect). (SPL-49535)</P> </BLOCKQUOTE> Tue, 18 Sep 2012 17:09:55 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-expected-behavior-of-setting-maxTotalDataSizeMB-0/m-p/61864#M12362 yannK 2012-09-18T17:09:55Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-expected-behavior-of-setting-maxTotalDataSizeMB-0/m-p/61865#M12363 <P>RUT ROH...</P> Tue, 18 Sep 2012 17:58:13 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-expected-behavior-of-setting-maxTotalDataSizeMB-0/m-p/61865#M12363 the_wolverine 2012-09-18T17:58:13Z