Deployment Architecture

How do we clear out some indexed data in our indexer cluster?

kiran331
Builder

Hi all,

We have 3 indexers in an indexer cluster environment. We're running out of space on 2 indexers and utilization is 90% of 600GB for each server.

indexes.conf

[cisco_asa]
homePath   = /u01/cisco_esa/db
coldPath   = /u01/cisco_esa/colddb
thawedPath = $SPLUNK_DB/cisco_esa/thaweddb
repFactor = auto
coldToFrozenDir = /u02/cisco_esa/frozen
# 100 days to frozen
frozenTimePeriodInSecs = 8640000
# 50 days to roll to cold
maxHotSpanSecs = 4320000
summaryHomePath = /u01/cisco_esa/dm_summary

This is the same thing for all indexes, so what is the best option to clear out some space and how can I delete some data from the above index for reducing some space?

0 Karma
1 Solution

masonmorales
Influencer

You can configure the maxTotalDataSizeMB = N under each index stanza in your indexes.conf and make sure that the sum of N does not exceed your available disk capacity. Restart Splunk after configuring it, and Splunk will start to freeze your oldest data.

There is a delete command, but it is a soft delete only (to make the data unsearchable) and does not reclaim disk space.

View solution in original post

masonmorales
Influencer

You can configure the maxTotalDataSizeMB = N under each index stanza in your indexes.conf and make sure that the sum of N does not exceed your available disk capacity. Restart Splunk after configuring it, and Splunk will start to freeze your oldest data.

There is a delete command, but it is a soft delete only (to make the data unsearchable) and does not reclaim disk space.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...