I have index "OS" with 90 gb space of data.
To reduce this space I assign Max size (MB) of hot/warm/cold bucket under index setting as 2000 MB
but still its not clean and its continuesly increasing.
Please some one let me know why we are assigning this max space and why its not clean extra data from OS index ?
The docs say that changing the setting will take some time to take affect. How long has it been since you made the change? Are there any buckets that have 'in-flight' in the name? Have you restarted Splunk recently?