in my stand alone environment
indexes.conf:
maxDataSize=100mb
maxTotalDataSizemb=200000
but in ui one of index current size is 40gb max size is 500gb
as i understood that maxdata size =100mb means when hot bucket ll reach 100mb that ll pass to anaotherbucket
and maxtotaldatasizemb=200000=200gb(hot+warm+cold)
than current size of 40gb means that data ll b in hot bucket or what ?
please clarify this one
Hi @dall,
when you configure an index in UI you have to declare the app containing the indexes.conf and few informations (paths, maxdatasize and few other thing).
using UI you don't setup retention etc...
You can setup these options later, modifying indexes.conf files.
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Indexesconf
I hint to follow the admin certification path to learn about this.
Ciao.
Giuseppe
Hi @dall,
your configuration means that:
Anyway, these values are set for each index, so if you have an index with a diferent configuration (500 max data size) probably it's differently set.
you can see the indexes configuration in two ways:
so you can intervene to change configurations.
Ciao.
Giuseppe
when created index in ui gave homepath,coldpath,thawedpath
not configured in indexes.conf for that particular index
not given any retention period ,maxdatasize and all
can i set now for that index and others also
is there any issue i ll face if i ll add in indexes.conf
Hi @dall,
when you configure an index in UI you have to declare the app containing the indexes.conf and few informations (paths, maxdatasize and few other thing).
using UI you don't setup retention etc...
You can setup these options later, modifying indexes.conf files.
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Indexesconf
I hint to follow the admin certification path to learn about this.
Ciao.
Giuseppe
thank u so much @gcusello