Getting Data In
Highlighted

Does the events get deleted after increasing maxTotalDataSizeMB?

Path Finder

The index reached 90% of its data size, does increasing the maxTotalDataSizeMB affects the older ingested events?

0 Karma
Highlighted

Re: Does the events get deleted after increasing maxTotalDataSizeMB?

Legend

@rajyah if you have Disk space available you can increase the size, older data should not get impacted. You can test out on any non-prod version or local instance.

Also you should be aware that data will still rollover to frozen depending on time selected for frozenTimePeriodInSecs.

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy




| eval message="Happy Splunking!!!"


View solution in original post

0 Karma
Highlighted

Re: Does the events get deleted after increasing maxTotalDataSizeMB?

Path Finder

Thank you very much.

0 Karma