index _internaldb db bigger than configured max of 5gb



We are running Splunk v splunk-7.0.0-c8a78efdd40f.x86_64 right now and we have a problem we the internaldb index size. Although we configured a maximum of 5gb it just keeps getting bigger (today we reached 19gb on a 25gb / Partition - dangerous ..) until we restart the Server - then it is instantly flushed and start again at 0. Is this normal? Judging from the default config there is no rotate "time" defined like we did for our application indexes. Should we change that?

Our application indexes are under a 1,5tb /var partition and are constantly being rotated, so this problem really affects only _internaldb size and maybe audit (might be that we had the same problem there in the past)

less ./etc/system/local/indexes.conf


enableOnlineBucketRepair = 1
enableDataIntegrityControl =
minStreamGroupQueueSize =
streamingTargetTsidxSyncPeriodMsec =
syncMeta = 1
maxTotalDataSizeMB = 5120
journalCompression =
bucketRebuildMemoryHint = 0
compressRawdata = 1
hotBucketTimeRefreshInterval =
maxDataSize = 1024000

Tags (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!