Getting Data In
Highlighted

Total Space For SplunkDB

Path Finder

Hi,

Now I know you can set the following in indexes.conf maxTotalDataSizeMB = 500000 which sets the max size of the DB on a per index basis?

However if you have say 3 or 4 indexes is there a way to set the maxDB size on the DB level i.e. not on the index level for all your indexes together?

Regards, Josh

Tags (1)
Highlighted

Re: Total Space For SplunkDB

Path Finder

Hi, i think there is no configurable way to do that because each index is it's own Database.

Highlighted

Re: Total Space For SplunkDB

Builder

It is possible to set a global value for all indexes in a single instance of Splunk. In fact, that is what the maxTotalDataSizeMB parameter does in $SPLUNK_HOME/etc/system/default/indexes.conf. You can override this per index by putting maxTotalDataSizeMB inside the index declaration. For example,

# set global parameter value
maxTotalDataSizeMB = 500000

[myindex]
# override here
maxTotalDataSizeMB = 1000000

But there is no way to specify groups and set the db size per group.

0 Karma
Highlighted

Re: Total Space For SplunkDB

Legend

This does not set a global default for the combined size. It sets the default value for each index for which the maxTotalDataSize is otherwise unspecified.

0 Karma
Highlighted

Re: Total Space For SplunkDB

Builder

Yes, sorry if that was not clear.

0 Karma
Highlighted

Re: Total Space For SplunkDB

Legend

There currently is not. We expect to have options for defining server-wide per-volume space limits for indexes.conf in version 4.2, which will be able to accomplish what you want.

Highlighted

Re: Total Space For SplunkDB

Motivator

Any chance this will also apply to bucket rotation? Having the ability to roll older buckets to cold/frozen based on free disk space would be a huge win. – southeringtonp 0 secs ago

0 Karma
Highlighted

Re: Total Space For SplunkDB

Legend

It will apply to hot and cold partitions also.

0 Karma
Highlighted

Re: Total Space For SplunkDB

Path Finder

Cool looking forward to 4.2 :-), we have quite a few indexes now due to the way we partition data for different user groups. Would be good to be able to set this max globally so we know we can never run out of disk space, imagine running out of disk space on a splunk server... now that wouldnt look goood would it!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.