Hi,
We are running Splunk v splunk-7.0.0-c8a78efdd40f.x86_64 right now and we have a problem we the internaldb index size. Although we configured a maximum of 5gb it just keeps getting bigger (today we reached 19gb on a 25gb / Partition - dangerous ..) until we restart the Server - then it is instantly flushed and start again at 0. Is this normal? Judging from the default config there is no rotate "time" defined like we did for our application indexes. Should we change that?
Our application indexes are under a 1,5tb /var partition and are constantly being rotated, so this problem really affects only _internaldb size and maybe audit (might be that we had the same problem there in the past)
less ./etc/system/local/indexes.conf
[default]
[_internal]
enableOnlineBucketRepair = 1
enableDataIntegrityControl =
minStreamGroupQueueSize =
streamingTargetTsidxSyncPeriodMsec =
syncMeta = 1
maxTotalDataSizeMB = 5120
journalCompression =
bucketRebuildMemoryHint = 0
compressRawdata = 1
hotBucketTimeRefreshInterval =
maxDataSize = 1024000
