Getting Data In

[Blog] Differentiate various size related parameters from indexes.conf

VatsalJagani
Champion

[Blog Post] Differentiate various size related parameters from indexes.conf

  • maxTotalDataSizeMB
  • maxGlobalRawDataSizeMB
  • maxGlobalDataSizeMB
  • maxDataSize
  • maxVolumeDataSizeMB
Labels (1)
1 Solution

VatsalJagani
Champion

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

View solution in original post

0 Karma

VatsalJagani
Champion

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...