What will happen when an index reaches its maximum size?

[calvintkng]

Just would like to know what will happen when an index reaches its maximum size? Will old data automatically be purged and continue to index new data?

[HiroshiSatoh · Accepted solution]

It becomes Frozen buckets.

Frozen :
Data rolled from cold. The indexer deletes frozen data by default, but you can also archive it. Archived data can later be thawed.

http://docs.splunk.com/Documentation/Splunk/6.1.3/Indexer/HowSplunkstoresindexes

[HiroshiSatoh]

If you run out of disk space, the indexer stops indexing.

http://docs.splunk.com/Documentation/Splunk/6.1.3/Indexer/Setlimitsondiskusage

maxDataSize,maxTotalDataSizeMB,frozenTimePeriodInSecs...etc

Please read the description of indexes.conf for the parameters to be set.

[calvintkng]

Thanks. So this mean if I set the maximum size of my index correct, I shouldn't run out of disk space. Right?