Now I know you can set the following in indexes.conf maxTotalDataSizeMB = 500000 which sets the max size of the DB on a per index basis?
However if you have say 3 or 4 indexes is there a way to set the maxDB size on the DB level i.e. not on the index level for all your indexes together?
It is possible to set a global value for all indexes in a single instance of Splunk. In fact, that is what the maxTotalDataSizeMB parameter does in $SPLUNK_HOME/etc/system/default/indexes.conf. You can override this per index by putting maxTotalDataSizeMB inside the index declaration. For example,
# set global parameter value maxTotalDataSizeMB = 500000 [myindex] # override here maxTotalDataSizeMB = 1000000
But there is no way to specify groups and set the db size per group.
There currently is not. We expect to have options for defining server-wide per-volume space limits for indexes.conf in version 4.2, which will be able to accomplish what you want.
Any chance this will also apply to bucket rotation? Having the ability to roll older buckets to cold/frozen based on free disk space would be a huge win. – southeringtonp 0 secs ago
Cool looking forward to 4.2 :-), we have quite a few indexes now due to the way we partition data for different user groups. Would be good to be able to set this max globally so we know we can never run out of disk space, imagine running out of disk space on a splunk server... now that wouldnt look goood would it!