Does the events get deleted after increasing maxTotalDataSizeMB?

[rajyah]

The index reached 90% of its data size, does increasing the maxTotalDataSizeMB affects the older ingested events?

[niketn · Accepted solution]

@rajyah if you have Disk space available you can increase the size, older data should not get impacted. You can test out on any non-prod version or local instance.

Also you should be aware that data will still rollover to frozen depending on time selected for frozenTimePeriodInSecs.

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

[rajyah]

Thank you very much.