Installation

index _internaldb db bigger than configured max of 5gb

mbessel
Engager

Hi,

We are running Splunk v splunk-7.0.0-c8a78efdd40f.x86_64 right now and we have a problem we the internaldb index size. Although we configured a maximum of 5gb it just keeps getting bigger (today we reached 19gb on a 25gb / Partition - dangerous ..) until we restart the Server - then it is instantly flushed and start again at 0. Is this normal? Judging from the default config there is no rotate "time" defined like we did for our application indexes. Should we change that?

Our application indexes are under a 1,5tb /var partition and are constantly being rotated, so this problem really affects only _internaldb size and maybe audit (might be that we had the same problem there in the past)

less ./etc/system/local/indexes.conf

[default]

[_internal]
enableOnlineBucketRepair = 1
enableDataIntegrityControl =
minStreamGroupQueueSize =
streamingTargetTsidxSyncPeriodMsec =
syncMeta = 1
maxTotalDataSizeMB = 5120
journalCompression =
bucketRebuildMemoryHint = 0
compressRawdata = 1
hotBucketTimeRefreshInterval =
maxDataSize = 1024000

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...