Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Splunk max size of hot/warm/cold bucket
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk max size of hot/warm/cold bucket
Hi
I have index "OS" with 90 gb space of data.
To reduce this space I assign Max size (MB) of hot/warm/cold bucket under index setting as 2000 MB
but still its not clean and its continuesly increasing.
Please some one let me know why we are assigning this max space and why its not clean extra data from OS index ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Please check indexes.conf at all precedence levels using the below and check is the max limit set at the highest precedence of indexes.conf
./splunk btool indexes list
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the bucket is not filled then it will keep filling them until the time has reached to roll it to frozen bucket. Please post you indexes.conf settings.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The docs say that changing the setting will take some time to take affect. How long has it been since you made the change? Are there any buckets that have 'in-flight' in the name? Have you restarted Splunk recently?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you seeing any errors or messages in the splunkd log for maxTotalDataSizeMB?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
version 6.0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of Splunk?
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
