Knowledge Management

Daily indexing volume limit exceeded and updating summary

stevengls
New Member

A directory got added as a data input that shouldn't have, and so now I have

"Daily indexing volume limit exceeded"

messages coming up. So I used the "| delete" function in the search to remove the sourcetype, but I am still getting this message and the data summary is still reporting the deleted data.

Reading everything I can about the clean command I don't think I want to use it, as I have some other good valid data in this splunk instance that I don't want to delete.

Am I missing something?

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

You get the warning because you exceeded the volume limit. It does not matter if you remove the data - the warning still counts, as the license is based on indexing volume, not storage volume. However, there is no reason to panic. The (visible) warning will go away tomorrow, and the actual warning will age out in 30 days. You're allowed 5 warnings in a rolling 30 day window before you get locked out.

As you've probably read in the docs, the delete command does not actually remove any data, it only removes the it from the index-file (.tsidx), i.e. removes the pointers to it. Unless it was a really huge amount of data, and you have disk space concerns, it's better to leave it as it is, and let it age out along with the other data according to the retention policy you have specified. If you did not specifically set such a policy, then event data will be purged (oldest first) from the index when it reaces 500GB in size or ~6 years age (whichever condition matches first).

Don't panic!

EDIT: typos and clarity

/K

0 Karma

kristian_kolb
Ultra Champion

not so sure what you mean by 'the summary data'. BTW, does it look better today?

/K

0 Karma

stevengls
New Member

But the summary data is also wrong. When does that update?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...