Cap daily indexation of an index

[internet_team]

Hello,

We currently have an index that has a size ranging from 3 to 7 Go per day, is there any way to limit the daily indexation to, lets say, 5 Go ?

Expected behaviour is : when the index size hits 5Go, it stops indexing new data to avoid license usage.

We already tried the thruput limitation in a limits.conf file and it does not work well enough for us. We'd also prefer not to have a Splunk alert launch a script on our servers.

Thanks in advance !

[esix_splunk · Accepted solution]

There is no way to do this currently with Splunk.

[internet_team]

Hello, thanks for the quick answer.

Is this going to be implemented in the near future ?

[esix_splunk]

Not in the near to distant future. If you talk to you account rep, ask them to file an ERD and request this. That can help!!