I am beginner in splunk and I had a doubt related to maxTotalDataSizeMB
property.
Assume, I have only one indexer. Now I have created many indexes like web_app
, iot
etc.
Now, a separate index Db created for them in our only indexer.
Now, when we mention value of maxTotalDataSizeMB
, does this apply to all indexes Db size in our only indexer
or individually on each one of them ?
It depends on where you define it within indexes.conf
This would apply to all indexes:
[default]
maxTotalDataSizeMB = 650000
To set it on a per index basis:
[index_01]
maxTotalDataSizeMB = 2500
[index_01]
maxTotalDataSizeMB = 3000
It depends on where you define it within indexes.conf
This would apply to all indexes:
[default]
maxTotalDataSizeMB = 650000
To set it on a per index basis:
[index_01]
maxTotalDataSizeMB = 2500
[index_01]
maxTotalDataSizeMB = 3000
Eh, typo there sorry. Should be index_01 and index_02, but you get the idea.