How do I fix low disk space in Enterprise indexer?

Fields29 — Tue, 23 Aug 2022 23:23:53 GMT

How do I fix low disk space in enterprise indexer.

Please comment back on how to fix.

Re: Indexer low disk space

richgalloway — Tue, 23 Aug 2022 20:55:09 GMT

There are two ways: 1) Add more disks; 2) delete some data.

There are many ways to reduce disk space use. If the $SPLUNK_DB space is shared with the OS or $SPLUNK_HOME (both bad ideas) then use the du utility to determine what is using up disk space and correct as necessary.

Check for old bundles and delete them.

You'll get the most return, however, by reducing indexed data. Reduce the frozenTimePeriodInSecs setting (it defaults to 7 years) for one or more of your indexes and restart the indexer.

topic How do I fix low disk space in Enterprise indexer? in Splunk Search

How do I fix low disk space in Enterprise indexer?

Re: Indexer low disk space