Yes, there are best practices, but that is a pretty general question. You should start by understanding how Splunk stores indexes and how to configure them in general.
But since you may be in a disk space crisis, I would first examine the maximum size of the main index (that is what is stored in defaultdb). I would make sure that maximum size is not going to allow the index to grow any larger. All of this can be done from the Splunk GUI under Settings.
Take a look at the documentation here: Manage Index Storage
You have many choices in configuring indexes, including both size and location of the various components. If this post doesn't answer your question, then please refine the question. What do you want to do? Make the index smaller, move it to a different disk drive, split it between drives, set a retention policy to remove older data, etc. Then the community can give you better advice.
