Getting Data In

Splunk max size of hot/warm/cold bucket

Communicator

Hi
I have index "OS" with 90 gb space of data.

To reduce this space I assign Max size (MB) of hot/warm/cold bucket under index setting as 2000 MB

but still its not clean and its continuesly increasing.

Please some one let me know why we are assigning this max space and why its not clean extra data from OS index ?

Tags (3)
0 Karma

Path Finder

Hi,

Please check indexes.conf at all precedence levels using the below and check is the max limit set at the highest precedence of indexes.conf
./splunk btool indexes list

0 Karma

Champion

If the bucket is not filled then it will keep filling them until the time has reached to roll it to frozen bucket. Please post you indexes.conf settings.

0 Karma

Super Champion

The docs say that changing the setting will take some time to take affect. How long has it been since you made the change? Are there any buckets that have 'in-flight' in the name? Have you restarted Splunk recently?

0 Karma

Super Champion

Are you seeing any errors or messages in the splunkd log for maxTotalDataSizeMB?

0 Karma

Communicator

version 6.0

0 Karma

Super Champion

What version of Splunk?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!