Getting Data In

How to troubleshoot why the maximum size is not used for an index?

o_calmels
Communicator

Hi,

My main index has a maximum size of 620 GB approx. So my index size was about 615 ~ 619 GB as it should be.
4 weeks ago, I got more disk space, so I extend this maximum size to 1450 GB. But now, my index is still about 615 ~ 619 GB since 4 weeks.
The architecture is distributed over two indexers, my two indexers have the same problem.
I index about 10 GB to 15 Gb per day per indexer, so my main index index should have grown since these 4 weeks !
I check my disk space, it is free and available.
I tried to restart splunkd, restart the entire server.

Do you know where I could find logs about this problem, or why my index doesn't fit all the space available for it.

thank's a lot !

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Note that there are two factors that control how big your index will get. One is the maximum size on disk (per indexer), the other one is your data retention settings (frozenTimePeriodinSecs). If your data ages out before your maximum size is reached, you will not see it grow to that max size. This may help further understand what Splunk does: Bucket Rotation and Retention

0 Karma

jeffland
Champion

What is the setting you use to set the maximum size of your index? Note that there are quite a few settings which control how your data ages.

0 Karma

jmallorquin
Builder

Hi,

In the menu setting >> indexes, did you see the new size?

Also you can use the command to check if the are any othe file with the incorrect size of the index.

./splunk cmd btool indexes list --debug

Remember to use

In indexes.conf

maxTotalDataSizeMB =

Hope help you.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!