Archive
Highlighted

how to limit _internal and _audit indexes capabilities in splunk ? why these indexes are taking large space compare to user index data ?

New Member

how to limit _internal and _audit indexes capabilities in splunk ? why these indexes are taking large space compare to user index data ?

Tags (1)
0 Karma
Highlighted

Re: how to limit _internal and _audit indexes capabilities in splunk ? why these indexes are taking large space compare to user index data ?

Super Champion

Generally the logs will take up a max of 125MB each because they keep 4 rolled files each and have a max size of 24MB each.

Normally, they don't get that large unless there is a problem, or the system has been installed for a long time.

It is possible that the logging levels are not at the defaults. If you want to view or change the logging levels and or set the max log file size for the various Splunk processes you can do it in the splunk/etc/log.cfg

You can also set them from Splunkweb at Manager>System Settings> System Logging.

0 Karma
Highlighted

Re: how to limit _internal and _audit indexes capabilities in splunk ? why these indexes are taking large space compare to user index data ?

Splunk Employee
Splunk Employee

Note that they don't count against your license usage.

0 Karma