topic Why is one indexer consuming much more physical disk space than the other indexers? in Getting Data In

Why is one indexer consuming much more physical disk space than the other indexers?

venkatesh296 — Mon, 16 Jan 2017 21:22:25 GMT

Hi Everyone,
In our environment we have two indexers, each one has 500 gb disk usage, but one indexer used almost 90% of disk usage other indexer used only 30%. Can anyone help regarding this?

Thanks.

Re: Why is one indexer consuming much more physical disk space than the other indexers?

nabeel652 — Tue, 17 Jan 2017 00:14:23 GMT

Is it the indexes that make the difference. Check your "Path to indexes" and is the size of the disk/folder of splunkdb on both indexers is the same? If yes, your indexes are being replicated properly but there is some other problem on one of your indexers.

Re: Why is one indexer consuming much more physical disk space than the other indexers?

MuS — Tue, 17 Jan 2017 01:21:56 GMT

Hi venkatesh296,

since you are not mentioning any replication in your question, I would suggest to check

indexes.conf on both servers if they are the same
check the outputs.conf used by any sending forwarder if they are using both indexers or just one
check out this answer about the so called server affinity https://answers.splunk.com/answers/168363/distributed-setup-question.html and maybe change the setting to forceTimebasedAutoLB = true in outputs.conf

Hope this helps to get you started ...

cheers, MuS

Re: Why is one indexer consuming much more physical disk space than the other indexers?

ddrillic — Tue, 17 Jan 2017 14:34:18 GMT

As a sanity check, can you please go to the License Usage Reporting panel in the License Master and run the Previous 30 days report, with Pool as All Pools and Split by as Indexer?