We have a shortage of space in one of the search heads. Should we delete data present in account_summarydb?

[Hemnaath]

Hi all,

We are currently facing a space crunch in one of the search heads (6.2.1 v) running in VMware, total file system size /opt is 133GB out of which 89GB is consumed by account_summarydb, audit, and _internal under this path /opt/splunk/var/lib/splunk. So kindly guide us with a solution that can control the size from further growing.

 df -h /opt
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_search01-opt_vol
                      133G  103G   24G  82% /opt

thanks in advance

[somesoni2]

Splunk recommends that you don't store any data in Search Head but forwarder all data to Indexers. Read below link for reason/benefits of doing so and process of setting up the same. This will resolve your spacing issue.

http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/Forwardsearchheaddata