How is disc space allocated to indexes on indexer?

[goelt2000]

We have a set of non clustered indexers. around 20. There is a duplicate entry of an index definition in indexes.conf. So, splunk is identifying the latest entry and implementing it.

If I delete the entry which is not active, what impact will it have?

Secondly, how is disc space allocated to indexes on indexer?

For example, if disc space allocated to index is 80% full, and I decrease the disc space by 50%, or  FrozenTimePeriodinSecs is increased or decreased, is the current indexed data deleted 100%, and new space is allocated or are the new policies, applied to the already existing data and the data which should not be available as per the new Policy(i.e. FrozenTimePeriodinSecs and/OR homePath.maxDataSizeMB and/or coldPath.maxDataSizeMB values) rolled off?

We are not archiving any data. So, after cold it is being deleted.

[richgalloway]

Unused entries in indexes.conf (or any other .conf file) can be removed without effect (other than recovering a tiny amount of disk space).  Run btool before and after making your changes to verify that.  Of course, backup your files before changing them.

Changes to retention settings apply the next time the indexer restarts.  Splunk does not re-store all indexed data, but instead applies the new settings when checking to see if a bucket should be frozen or not (which it does every minute, IIRC).  Buckets which do not meet the current retention settings are rolled off.