https://community.splunk.com/t5/Monitoring-Splunk/Indexer-disk-utilisation-critical/m-p/538245#M4771 <P>I have a warning on Monitoring console of my cluster master, that my Index disk utilisation is critically high. I have a 30 day retention policy set on all my indexes however the disk utilisation is continuing to rise.</P><P>In monitoring console - Indexing - indexes and volumes - instance - Indexes table.</P><P>I am seeing Data Age vs Frozen age that I have data much older than my retention policy.</P><P>To me that would suggest I have hot buckets that have not rolled over perhaps due to data ingest latency or incorrect timestamps preventing the roll over.</P><P>Could this be the source of my increasing disk utilisation?</P><P>My understanding is that if a rolling restart of my Indexers occurred then all buckets would roll over, however I know there has been a restart within the time frame indicated by the data age.</P> Tue, 02 Feb 2021 09:19:24 GMT Martin583 2021-02-02T09:19:24Z https://community.splunk.com/t5/Monitoring-Splunk/Indexer-disk-utilisation-critical/m-p/538245#M4771 <P>I have a warning on Monitoring console of my cluster master, that my Index disk utilisation is critically high. I have a 30 day retention policy set on all my indexes however the disk utilisation is continuing to rise.</P><P>In monitoring console - Indexing - indexes and volumes - instance - Indexes table.</P><P>I am seeing Data Age vs Frozen age that I have data much older than my retention policy.</P><P>To me that would suggest I have hot buckets that have not rolled over perhaps due to data ingest latency or incorrect timestamps preventing the roll over.</P><P>Could this be the source of my increasing disk utilisation?</P><P>My understanding is that if a rolling restart of my Indexers occurred then all buckets would roll over, however I know there has been a restart within the time frame indicated by the data age.</P> Tue, 02 Feb 2021 09:19:24 GMT https://community.splunk.com/t5/Monitoring-Splunk/Indexer-disk-utilisation-critical/m-p/538245#M4771 Martin583 2021-02-02T09:19:24Z