Is it safe to modify maxTotalDataSizeMB in a clustered environment (indexes.conf)?

[splunkreal]

Hello,

maxTotalDataSizeMB of one index is too large, is it possible to reduce it (above current size of course), without any problem?

Thanks.

[esix_splunk]

This needs to be changed on the Cluster Master Node, under the $splunk_home$/etc/master-apps/ structure, and then deployed to your cluster.

Adding this on your individual indexers will cause problems and should not be done.

[ddrillic]

It should be just fine.

How can I change index size in cluster ?

@ChrisG says -

The link to @chrisG seems to be broken...