Splunk max size of hot/warm/cold bucket

[rameshlpatel]

Hi
I have index "OS" with 90 gb space of data.

To reduce this space I assign Max size (MB) of hot/warm/cold bucket under index setting as 2000 MB

but still its not clean and its continuesly increasing.

Please some one let me know why we are assigning this max space and why its not clean extra data from OS index ?

[merp96]

Hi,

Please check indexes.conf at all precedence levels using the below and check is the max limit set at the highest precedence of indexes.conf
./splunk btool indexes list

[linu1988]

If the bucket is not filled then it will keep filling them until the time has reached to roll it to frozen bucket. Please post you indexes.conf settings.

[lukejadamec]

The docs say that changing the setting will take some time to take affect. How long has it been since you made the change? Are there any buckets that have 'in-flight' in the name? Have you restarted Splunk recently?

[lukejadamec]

Are you seeing any errors or messages in the splunkd log for maxTotalDataSizeMB?

[rameshlpatel]

version 6.0

[lukejadamec]

What version of Splunk?