How Indexers behave when it comes into detention state ?

[tsawa_splunk]

I understand Splunk provides multiple means to control the disk size for indexing, and I want to understand better around minFreeSpace option which is specified in server.conf.

If the actual usage of the filesystem exceeds the threshold specified by minFreeSpace, how will the data which was seized from being indexed be handled after the disk space gets freed ? As long as the ack on Forwarder is enabled, will the data again be collected and indexed, or will it be just lost ?

I assume the result may be varied across types of input, forwarder, tcp/udp, HEC, etc ...
Any detailed answer would be highly appreciated.

[FrankVl · Accepted solution]

If an indexer goes into detention, it will stop accepting new data on its inputs. If you have multiple indexers and you've set up your forwarders to load balance across your indexers, they will simply divert to the other indexers. If you have only a single indexer, then queues will start filling up on your forwarders and once those are full, their inputs will also block. In some cases your data sources may cache and resend once the blockage is over, but in many cases data will start to get lost (especially with 'unreliable' transport methods like UDP).

[deepashri_123]

Hey tsawa,

Refer these documentation below:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Usepersistentqueues
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Setlimitsondiskusage
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/HowSplunkstoresindexes

Let me know if this helps!!