Daily indexing volume limit exceeded and updating summary

[stevengls]

A directory got added as a data input that shouldn't have, and so now I have

"Daily indexing volume limit exceeded"

messages coming up. So I used the "| delete" function in the search to remove the sourcetype, but I am still getting this message and the data summary is still reporting the deleted data.

Reading everything I can about the clean command I don't think I want to use it, as I have some other good valid data in this splunk instance that I don't want to delete.

Am I missing something?

[kristian_kolb]

You get the warning because you exceeded the volume limit. It does not matter if you remove the data - the warning still counts, as the license is based on indexing volume, not storage volume. However, there is no reason to panic. The (visible) warning will go away tomorrow, and the actual warning will age out in 30 days. You're allowed 5 warnings in a rolling 30 day window before you get locked out.

As you've probably read in the docs, the delete command does not actually remove any data, it only removes the it from the index-file (.tsidx), i.e. removes the pointers to it. Unless it was a really huge amount of data, and you have disk space concerns, it's better to leave it as it is, and let it age out along with the other data according to the retention policy you have specified. If you did not specifically set such a policy, then event data will be purged (oldest first) from the index when it reaces 500GB in size or ~6 years age (whichever condition matches first).

Don't panic!

EDIT: typos and clarity

/K

[kristian_kolb]

not so sure what you mean by 'the summary data'. BTW, does it look better today?

/K

[stevengls]

But the summary data is also wrong. When does that update?