topic Re: What is a simple way to clear some space if I'm running out of disk space allocated for indexes? in Monitoring Splunk https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224756#M2239 <P>Yes, the indexes.conf for these internal indexes will available in <CODE>$SPLUNK_HOME/etc/system/default</CODE>. DO NOT UPDATE that copy. Instead create an indexes.conf in <CODE>$SPLUNK_HOME/etc/system/local</CODE> OR any app to update the stanza for <CODE>_internal</CODE> and <CODE>_introspection</CODE> indexes.</P> Tue, 01 Mar 2016 17:29:52 GMT somesoni2 2016-03-01T17:29:52Z What is a simple way to clear some space if I'm running out of disk space allocated for indexes? https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224753#M2236 <P>The indexes almost consumed the entire terabyte of space allocated for them. What would be a simple way to clear some space?</P> Mon, 29 Feb 2016 17:03:16 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224753#M2236 ddrillic 2016-02-29T17:03:16Z Re: What is a simple way to clear some space if I'm running out of disk space allocated for indexes? https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224754#M2237 <P>The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy">http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy</A></P> Mon, 29 Feb 2016 17:12:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224754#M2237 somesoni2 2016-02-29T17:12:53Z Re: What is a simple way to clear some space if I'm running out of disk space allocated for indexes? https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224755#M2238 <P>You are absolutely right -</P> <P>We see -</P> <P>234G _internaldb<BR /> 14G _introspection</P> <P>Can we handle them like any other index?</P> Tue, 01 Mar 2016 15:35:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224755#M2238 ddrillic 2016-03-01T15:35:50Z Re: What is a simple way to clear some space if I'm running out of disk space allocated for indexes? https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224756#M2239 <P>Yes, the indexes.conf for these internal indexes will available in <CODE>$SPLUNK_HOME/etc/system/default</CODE>. DO NOT UPDATE that copy. Instead create an indexes.conf in <CODE>$SPLUNK_HOME/etc/system/local</CODE> OR any app to update the stanza for <CODE>_internal</CODE> and <CODE>_introspection</CODE> indexes.</P> Tue, 01 Mar 2016 17:29:52 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224756#M2239 somesoni2 2016-03-01T17:29:52Z Re: What is a simple way to clear some space if I'm running out of disk space allocated for indexes? https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224757#M2240 <P>Makes perfect sense - much appreciated. </P> Thu, 03 Mar 2016 15:28:15 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-is-a-simple-way-to-clear-some-space-if-I-m-running-out-of/m-p/224757#M2240 ddrillic 2016-03-03T15:28:15Z