Dashboards & Visualizations

index.conf file query

isha_ish
Engager

what does the below DataSize MB means on the index.conf file. just wanted to know how it works

 

homePath = volume:hot1/fxmp_core_prod/db
coldPath = volume:cold1/fxmp_core_prod/colddb
thawedPath = $SPLUNK_DB/fxmp_core_prod/thaweddb
homePath.maxDataSizeMB = 2048 --> what does this implies
maxTotalDataSizeMB = 5120 --> what does this implies

Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust
homePath.maxDataSizeMB = <nonnegative integer>
* Specifies the maximum size of 'homePath' (which contains hot and warm
  buckets).
* If this size is exceeded, splunkd moves buckets with the oldest value
  of latest time (for a given bucket) into the cold DB until homePath is
  below the maximum size.
* If you set this setting to 0, or do not set it, splunkd does not constrain the
  size of 'homePath'.
* The highest legal value is 4294967295.
* Splunkd ignores this setting for remote storage enabled indexes.
* Default: 0

 

maxTotalDataSizeMB = <nonnegative integer>
* The maximum size of an index, in megabytes.
* If an index grows larger than the maximum size, splunkd freezes the oldest
  data in the index.
* This setting only applies to hot, warm, and cold buckets. It does
  not apply to thawed buckets.
* CAUTION: This setting takes precedence over other settings like
  'frozenTimePeriodInSecs' with regard to data retention. If the index
  grows beyond 'maxTotalDataSizeMB' megabytes before
  'frozenTimePeriodInSecs' seconds have passed, data could prematurely
  roll to frozen. As the default policy for rolling data to frozen is
  deletion, unintended data loss could occur.
* Splunkd ignores this setting on remote storage enabled indexes.
* Highest legal value is 4294967295
* Default: 500000


 

https://docs.splunk.com/Documentation/Splunk/8.0.6/Admin/Indexesconf

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

homePath.maxDataSizeMB specifies how much disk space the hot and warm buckets can use.  Once this limit is reached buckets are rolled to cold.

maxTotalDataSizeMB specifies how much disk space the hot, warm, and cold buckets can use.  Once this limit is reached buckets are frozen.

See $SPLUNK_HOME/etc/system/README/indexes.conf.spec

---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...