Getting Data In

Total Space For SplunkDB

Path Finder

Hi,

Now I know you can set the following in indexes.conf maxTotalDataSizeMB = 500000 which sets the max size of the DB on a per index basis?

However if you have say 3 or 4 indexes is there a way to set the maxDB size on the DB level i.e. not on the index level for all your indexes together?

Regards, Josh

Tags (1)

Splunk Employee
Splunk Employee

There currently is not. We expect to have options for defining server-wide per-volume space limits for indexes.conf in version 4.2, which will be able to accomplish what you want.

Path Finder

Cool looking forward to 4.2 :-), we have quite a few indexes now due to the way we partition data for different user groups. Would be good to be able to set this max globally so we know we can never run out of disk space, imagine running out of disk space on a splunk server... now that wouldnt look goood would it!

0 Karma

Splunk Employee
Splunk Employee

It will apply to hot and cold partitions also.

0 Karma

Motivator

Any chance this will also apply to bucket rotation? Having the ability to roll older buckets to cold/frozen based on free disk space would be a huge win. – southeringtonp 0 secs ago

0 Karma

Splunk Employee
Splunk Employee

It is possible to set a global value for all indexes in a single instance of Splunk. In fact, that is what the maxTotalDataSizeMB parameter does in $SPLUNK_HOME/etc/system/default/indexes.conf. You can override this per index by putting maxTotalDataSizeMB inside the index declaration. For example,

# set global parameter value
maxTotalDataSizeMB = 500000

[myindex]
# override here
maxTotalDataSizeMB = 1000000

But there is no way to specify groups and set the db size per group.

0 Karma

Splunk Employee
Splunk Employee

Yes, sorry if that was not clear.

0 Karma

Splunk Employee
Splunk Employee

This does not set a global default for the combined size. It sets the default value for each index for which the maxTotalDataSize is otherwise unspecified.

0 Karma

Path Finder

Hi, i think there is no configurable way to do that because each index is it's own Database.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!