Total Space For SplunkDB

[Josh]

Hi,

Now I know you can set the following in indexes.conf maxTotalDataSizeMB = 500000 which sets the max size of the DB on a per index basis?

However if you have say 3 or 4 indexes is there a way to set the maxDB size on the DB level i.e. not on the index level for all your indexes together?

Regards, Josh

[gkanapathy]

There currently is not. We expect to have options for defining server-wide per-volume space limits for indexes.conf in version 4.2, which will be able to accomplish what you want.

[Josh]

Cool looking forward to 4.2 :-), we have quite a few indexes now due to the way we partition data for different user groups. Would be good to be able to set this max globally so we know we can never run out of disk space, imagine running out of disk space on a splunk server... now that wouldnt look goood would it!

[gkanapathy]

It will apply to hot and cold partitions also.

[southeringtonp]

Any chance this will also apply to bucket rotation? Having the ability to roll older buckets to cold/frozen based on free disk space would be a huge win. – southeringtonp 0 secs ago

[hulahoop]

It is possible to set a global value for all indexes in a single instance of Splunk. In fact, that is what the maxTotalDataSizeMB parameter does in $SPLUNK_HOME/etc/system/default/indexes.conf. You can override this per index by putting maxTotalDataSizeMB inside the index declaration. For example,

# set global parameter value
maxTotalDataSizeMB = 500000

[myindex]
# override here
maxTotalDataSizeMB = 1000000

But there is no way to specify groups and set the db size per group.

[hulahoop]

Yes, sorry if that was not clear.

[gkanapathy]

This does not set a global default for the combined size. It sets the default value for each index for which the maxTotalDataSize is otherwise unspecified.

[Christian]

Hi, i think there is no configurable way to do that because each index is it's own Database.