How to troubleshoot why the maximum size is not used for an index?

[o_calmels]

Hi,

My main index has a maximum size of 620 GB approx. So my index size was about 615 ~ 619 GB as it should be.
4 weeks ago, I got more disk space, so I extend this maximum size to 1450 GB. But now, my index is still about 615 ~ 619 GB since 4 weeks.
The architecture is distributed over two indexers, my two indexers have the same problem.
I index about 10 GB to 15 Gb per day per indexer, so my main index index should have grown since these 4 weeks !
I check my disk space, it is free and available.
I tried to restart splunkd, restart the entire server.

Do you know where I could find logs about this problem, or why my index doesn't fit all the space available for it.

thank's a lot !

[s2_splunk]

Note that there are two factors that control how big your index will get. One is the maximum size on disk (per indexer), the other one is your data retention settings (frozenTimePeriodinSecs). If your data ages out before your maximum size is reached, you will not see it grow to that max size. This may help further understand what Splunk does: Bucket Rotation and Retention

[jeffland]

What is the setting you use to set the maximum size of your index? Note that there are quite a few settings which control how your data ages.

[jmallorquin]

Hi,

In the menu setting >> indexes, did you see the new size?

Also you can use the command to check if the are any othe file with the incorrect size of the index.

./splunk cmd btool indexes list --debug

Remember to use

In indexes.conf

maxTotalDataSizeMB =

Hope help you.