https://community.splunk.com/t5/Getting-Data-In/Why-do-I-still-get-quot-Daily-indexing-volume-limit-exceeded/m-p/48312#M9141 <P>thx for the reply. Yup, this is under the free license. I was trying to avoid going over the indexing limit by limiting the index size itself. But from your response it does look like I'll have to find ways to limiting the data input itself.</P> Thu, 10 May 2012 16:43:14 GMT klops 2012-05-10T16:43:14Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-still-get-quot-Daily-indexing-volume-limit-exceeded/m-p/48310#M9139 <P>On this particular installation I don't care about historical data. So I set maxTotalDataSizeMB to 500mb. </P> <P>However I still get hit by "Daily indexing volume limit exceeded" error when there are a lot of junk logging data coming to the indexer. </P> Thu, 10 May 2012 15:45:45 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-still-get-quot-Daily-indexing-volume-limit-exceeded/m-p/48310#M9139 klops 2012-05-10T15:45:45Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-still-get-quot-Daily-indexing-volume-limit-exceeded/m-p/48311#M9140 <P>Because Splunk will drop old events from the bucket and fill it with new ones, you could have hundreds of gigs of data pass through a bucket of 500mb. You need to restrict what you are sending to the indexer or <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad">use the nullQueue to dump events before hitting the index</A></P> <P>Oh and just to be clear, I assume you are using a free/trial license? If so that is limited to indexing only 500mb a day, so as explained above you are exceeding this which is causing the warnings. If you do it three times or more within a 30 day rolling period on a free or trial license then you will lose the ability to search for 30 days.</P> Thu, 10 May 2012 16:25:44 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-still-get-quot-Daily-indexing-volume-limit-exceeded/m-p/48311#M9140 Drainy 2012-05-10T16:25:44Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-still-get-quot-Daily-indexing-volume-limit-exceeded/m-p/48312#M9141 <P>thx for the reply. Yup, this is under the free license. I was trying to avoid going over the indexing limit by limiting the index size itself. But from your response it does look like I'll have to find ways to limiting the data input itself.</P> Thu, 10 May 2012 16:43:14 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-still-get-quot-Daily-indexing-volume-limit-exceeded/m-p/48312#M9141 klops 2012-05-10T16:43:14Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-still-get-quot-Daily-indexing-volume-limit-exceeded/m-p/48313#M9142 <P>Its quite easy to do and if you use the Universal Forwarder on your remote systems then you can do some more filtering before sending data on <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Also if its helped then consider clicking the tick below the up and down arrow to the left of my answer, it will help others will similar problems in the future</P> Thu, 10 May 2012 19:09:06 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-still-get-quot-Daily-indexing-volume-limit-exceeded/m-p/48313#M9142 Drainy 2012-05-10T19:09:06Z