How can I limit disk space usage in Splunk / Netapp Ontap App?

[nicolay_koecher]

Hello,

In my environment I use Splunk and netapp ontap app. The index is on a separate nfs Vol 400GB in size. My current usage is about 78%.

I limited the file /opt/splunk/etc/apps/Splunk/etc/apps/Splunk_TA_ontap/local/indexes.conf to

[default]
maxTotalDataSizeMB = 200000
frozentimePeriodInSecs = 2592000

What thakes precedence?

I also limited /opt/splunk/etc/apps/Splunk/etc/apps/sa-Utils/default/tsidx_retention.conf

maxTotalDataSizeMB = 100000
retentionTimePeriodInSecs = 188697600

same question --> What takes precedence?

Any useful suggestions in how to limit this?

thanks
Nico

[mgildenhorn_spl]

For the indexes.conf - maxTotalDataSizeMB is the TOTAL space that all of the indexed data will reside in (Hot+Warm+Cold). frozentimePeriodInSecs will determine when older data moves out of Hot+Warm+Cold. Whichever parameter reaches its limit first will detemine how the buckets are aged out. So to directly answer your question, the one that takes precedence depends on which parameter hits the limit first.

Same holds true for tsidx_retention.conf parameters.

[halr9000]

I changed your tags to help get the right answer as this isn't specific to the NetApp app.

Here is a start: http://wiki.splunk.com/Deploy:BucketRotationAndRetention