Knowledge Management

Daily indexing volume limit exceeded and updating summary

stevengls
New Member

A directory got added as a data input that shouldn't have, and so now I have

"Daily indexing volume limit exceeded"

messages coming up. So I used the "| delete" function in the search to remove the sourcetype, but I am still getting this message and the data summary is still reporting the deleted data.

Reading everything I can about the clean command I don't think I want to use it, as I have some other good valid data in this splunk instance that I don't want to delete.

Am I missing something?

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

You get the warning because you exceeded the volume limit. It does not matter if you remove the data - the warning still counts, as the license is based on indexing volume, not storage volume. However, there is no reason to panic. The (visible) warning will go away tomorrow, and the actual warning will age out in 30 days. You're allowed 5 warnings in a rolling 30 day window before you get locked out.

As you've probably read in the docs, the delete command does not actually remove any data, it only removes the it from the index-file (.tsidx), i.e. removes the pointers to it. Unless it was a really huge amount of data, and you have disk space concerns, it's better to leave it as it is, and let it age out along with the other data according to the retention policy you have specified. If you did not specifically set such a policy, then event data will be purged (oldest first) from the index when it reaces 500GB in size or ~6 years age (whichever condition matches first).

Don't panic!

EDIT: typos and clarity

/K

0 Karma

kristian_kolb
Ultra Champion

not so sure what you mean by 'the summary data'. BTW, does it look better today?

/K

0 Karma

stevengls
New Member

But the summary data is also wrong. When does that update?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...