Deployment Architecture

How to change the index size of _audit index on a cluster?

agentguerry
Path Finder

I have a cluster set up with 1 index master, and 2 index peers.

I would like to change the size of the _audit index from 500G to 400G.

How can I go about changing these? On my index master, in the inputs.conf file that gets pushed out, there is no _audit index since these are created from splunk setup. I cannot go to each peer and change them manually, b/c the peers are part of a cluster.

Thanks!

0 Karma

mayurr98
Super Champion

On both indexers, you would need to create a stanza.
go to $SPLUNK_HOME/etc/system/local/indexes.conf

and create

[_audit]

0 Karma

agentguerry
Path Finder

would doing that clobber the existing data/index that is on the peer servers?

0 Karma

mayurr98
Super Champion

no it won't

0 Karma

mayurr98
Super Champion
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...