Getting Data In

Is it safe to modify maxTotalDataSizeMB in a clustered environment (indexes.conf)?



maxTotalDataSizeMB of one index is too large, is it possible to reduce it (above current size of course), without any problem?


0 Karma

Splunk Employee
Splunk Employee

This needs to be changed on the Cluster Master Node, under the $splunk_home$/etc/master-apps/ structure, and then deployed to your cluster.

Adding this on your individual indexers will cause problems and should not be done.

Ultra Champion

It should be just fine.

How can I change index size in cluster ?

@ChrisG says -

alt text

The link to @chrisG seems to be broken...