Getting Data In

Index Size varies between master dashoboard and peers

basilis
Explorer

Hello facing some issues with indexes size:

I have a Factor2 splunk cluster configured, and I'm facing this issue.

Master's node dashboard

   RepFactor SearchFactor   Size

index 2 2 282 56.05 GB

Index peer 1

index 500,000 None size=187,418 MB

replication is Auto and when I do

du -sh into the db the volume is 185 GB as peer indicates. Why the master dashboard indicate different value??

Thanks in advance

Tags (2)

basilis
Explorer

Ok,

thanks a lot for your response. Thought I had misconfigured something.

Regards

0 Karma

hexx
Splunk Employee
Splunk Employee

As I just confirmed with our developers, the index size indicated by the cluster manager page is the size of the compressed rawdata only, and it only counts one copy per existing bucket.

Given how counter-intuitive this is, I have filed a bug (internal reference SPL-69952) to get this value changed to reflect the actual disk usage of the replicated index, including all bucket data and copies.

sowings
Splunk Employee
Splunk Employee

1) How many peers do you have?

2) Are you using Report Acceleration?

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...