Getting Data In
Highlighted

What will happen when an index reaches its maximum size?

New Member

Just would like to know what will happen when an index reaches its maximum size? Will old data automatically be purged and continue to index new data?

Tags (2)
0 Karma
Highlighted

Re: What will happen when an index reaches its maximum size?

Champion

It becomes Frozen buckets.

Frozen :
Data rolled from cold. The indexer deletes frozen data by default, but you can also archive it. Archived data can later be thawed.

http://docs.splunk.com/Documentation/Splunk/6.1.3/Indexer/HowSplunkstoresindexes

View solution in original post

Highlighted

Re: What will happen when an index reaches its maximum size?

New Member

Thanks. So this mean if I set the maximum size of my index correct, I shouldn't run out of disk space. Right?

0 Karma
Highlighted

Re: What will happen when an index reaches its maximum size?

Champion

If you run out of disk space, the indexer stops indexing.

http://docs.splunk.com/Documentation/Splunk/6.1.3/Indexer/Setlimitsondiskusage

maxDataSize,maxTotalDataSizeMB,frozenTimePeriodInSecs...etc

Please read the description of indexes.conf for the parameters to be set.