Getting Data In

Skipped indexing error

mznikkip
Engager

I have two indexers and both are forwarding their data to the other. Today I saw an error stating Splunk skipping indexing, etc. I checked the disk space for each: 1 is at 94% utilization and the other at 14%. I'm assuming that since I am forwarding data the disk space is being used up fast. How do I resolve this problem? I read the section on setting disk limits; it seems that the index for os is approaching its limit on both indexers. Do I need to erase some data or increase the disk limit?

Tags (2)
0 Karma

Takajian
Builder

If you want to store more data onn your indexers, you need to increase the disk space. Otherwise, you need to erase data in order to keep available disk space for indexing new data.

0 Karma

mznikkip
Engager

And by increasing disk space, you mean increasing the limit that is set in Manager > Indexes? Do I increase the limit of the 'os' index or the 'main' index or both?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...

Index This | What is feather-light but cannot be held long?

May 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

.conf26 Registration is Live: Secure Your Early Bird Pass Now

  Lock in Your Spot: Registration Open for .conf26 in Denver Hello Splunkers, I have exciting news! Your ...