Deployment Architecture

How do I quickly make some space on the $SPLUNK_DB partition?

mctester
Communicator

The splunk cold storage file system is 100% full. I'm relatively new to splunk & not sure the proper way to purge.

Tags (3)
0 Karma
1 Solution

Mick
Splunk Employee
Splunk Employee

The easiest way to free up some space is to manually move some directories to an alternate location. If you want to keep the data, make sure you have an archive volume to move it to, if you don't care about the data, you can simply delete it.

As long as you move entire 'buckets' of data you shouldn't run into any trouble. A complete bucket is everything inside a directory with the name format - db_, eg - db_1250709009_1250705372_75

This format tells you the latest event in the bucket (timestamp1), the earliest event (timestamp2), and hence the bucket-span, and finally the ID which was assigned to it on completion. Each bucket ID within an index must be unique. Click here for a more in-depth explanation of how buckets work.

If you want to configure Splunk to manage disk-space itself, then you will want to consider a retirement policy.

View solution in original post

BunnyHop
Contributor

You can easily move buckets either through attaching a script each buckets or make a pointer to the storage of the cold folder/repository on the indexes.conf.

0 Karma

Mick
Splunk Employee
Splunk Employee

The easiest way to free up some space is to manually move some directories to an alternate location. If you want to keep the data, make sure you have an archive volume to move it to, if you don't care about the data, you can simply delete it.

As long as you move entire 'buckets' of data you shouldn't run into any trouble. A complete bucket is everything inside a directory with the name format - db_, eg - db_1250709009_1250705372_75

This format tells you the latest event in the bucket (timestamp1), the earliest event (timestamp2), and hence the bucket-span, and finally the ID which was assigned to it on completion. Each bucket ID within an index must be unique. Click here for a more in-depth explanation of how buckets work.

If you want to configure Splunk to manage disk-space itself, then you will want to consider a retirement policy.

Simeon
Splunk Employee
Splunk Employee

Be aware that you should not move buckets while Splunk is online. If Splunk tries to search data within a bucket, it will throw an error and possibly crash.

Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...