Deployment Architecture

We have a shortage of space in one of the search heads. Should we delete data present in account_summarydb?

Motivator

Hi all,

We are currently facing a space crunch in one of the search heads (6.2.1 v) running in VMware, total file system size /opt is 133GB out of which 89GB is consumed by account_summarydb, audit, and _internal under this path /opt/splunk/var/lib/splunk. So kindly guide us with a solution that can control the size from further growing.

 df -h /opt
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_search01-opt_vol
                      133G  103G   24G  82% /opt

thanks in advance

0 Karma

Revered Legend

Splunk recommends that you don't store any data in Search Head but forwarder all data to Indexers. Read below link for reason/benefits of doing so and process of setting up the same. This will resolve your spacing issue.

http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/Forwardsearchheaddata

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!