Getting Data In

[Blog] Differentiate various size related parameters from indexes.conf

VatsalJagani
SplunkTrust
SplunkTrust

[Blog Post] Differentiate various size related parameters from indexes.conf

  • maxTotalDataSizeMB
  • maxGlobalRawDataSizeMB
  • maxGlobalDataSizeMB
  • maxDataSize
  • maxVolumeDataSizeMB
Labels (1)
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...