Can we limit disk usage at the default stanza of indexes.conf?

[ddrillic]

Is it possible to set maxTotalDataSizeMB to let's say 6 TBs in the default stanza?

We are at 98% disk utilization ; -)

[damann · Accepted solution]

so maxVolumeDataSizeMB should be the option you are looking for.
Did you already took a look in the docs for maxTotalDataSizeMB, maxGlobalDataSizeMB and maxVolumeDataSizeMB ?

Quote from indexes.conf docs:
maxVolumeDataSizeMB: If set, this attribute limits the total size of all databases that reside
on this volume to the maximum size specified, in MB. Note that this it
will act only on those indexes which reference this volume, not on the
total size of the path set in the path attribute of this volume.

[ddrillic]

Gorgeous!!

[ddrillic]

Apparently without defining the volume we can't use this maxVolumeDataSizeMB configuration.

[damann]

Sure. have a look in the docs for indexes.conf : https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/Indexesconf

maxVolumeDataSizeMB = positive integer

should be the right option for you

[ddrillic]

Right, can we do it in the default stanza?

[damann]

sure, everything you define in the default stanza will be applied globally on all your indexes

[ddrillic]

Oh, but we need to limit the total usage of all the indexes...