Getting Data In

[Blog] Differentiate various size related parameters from indexes.conf

VatsalJagani
SplunkTrust
SplunkTrust

[Blog Post] Differentiate various size related parameters from indexes.conf

  • maxTotalDataSizeMB
  • maxGlobalRawDataSizeMB
  • maxGlobalDataSizeMB
  • maxDataSize
  • maxVolumeDataSizeMB
Labels (1)
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...