topic Re: disk space allocation for newly created index in Monitoring Splunk

disk space allocation for newly created index

riqbal47010 — Fri, 05 Jun 2020 23:35:54 GMT

will at the time of index creation the defined disk size allocated once. or it is allocated based on index utilization.

Re: disk space allocation for newly created index

gcusello — Mon, 09 Mar 2020 13:43:08 GMT

Hi @riqbal47010,
it's allocated at the index creation time but it's possible to change also in a second time (and many times), but it isn't dinamic (not allocated based on index utilization).
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf .

Ciao.
Giuseppe

Re: disk space allocation for newly created index

riqbal47010 — Mon, 09 Mar 2020 13:48:32 GMT

So in cluster environment, I create some Indexes for POC products. like recorded future. I created one index for recorded future at the time of POC. after that I am not receiving the data even the data that I received passed its retention policy. it was written to Archive. Now that index has zero events.
how can I reclaim my disk space back.

Re: disk space allocation for newly created index

gcusello — Mon, 09 Mar 2020 15:15:50 GMT

Hi @riqbal47010,
if your index is present in one indexes.conf file, managed by the Master Node, you can use it: you haven't to reclaim your disk space back.
If not, you have to ask to the Splunk admin to rebuild it.

Ciao.
Giuseppe