Deployment Architecture

How do we clear out some indexed data in our indexer cluster?

kiran331
Builder

Hi all,

We have 3 indexers in an indexer cluster environment. We're running out of space on 2 indexers and utilization is 90% of 600GB for each server.

indexes.conf

[cisco_asa]
homePath   = /u01/cisco_esa/db
coldPath   = /u01/cisco_esa/colddb
thawedPath = $SPLUNK_DB/cisco_esa/thaweddb
repFactor = auto
coldToFrozenDir = /u02/cisco_esa/frozen
# 100 days to frozen
frozenTimePeriodInSecs = 8640000
# 50 days to roll to cold
maxHotSpanSecs = 4320000
summaryHomePath = /u01/cisco_esa/dm_summary

This is the same thing for all indexes, so what is the best option to clear out some space and how can I delete some data from the above index for reducing some space?

0 Karma
1 Solution

masonmorales
Influencer

You can configure the maxTotalDataSizeMB = N under each index stanza in your indexes.conf and make sure that the sum of N does not exceed your available disk capacity. Restart Splunk after configuring it, and Splunk will start to freeze your oldest data.

There is a delete command, but it is a soft delete only (to make the data unsearchable) and does not reclaim disk space.

View solution in original post

masonmorales
Influencer

You can configure the maxTotalDataSizeMB = N under each index stanza in your indexes.conf and make sure that the sum of N does not exceed your available disk capacity. Restart Splunk after configuring it, and Splunk will start to freeze your oldest data.

There is a delete command, but it is a soft delete only (to make the data unsearchable) and does not reclaim disk space.

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...