Monitoring Splunk

Are there maintenance steps or best practices around managing the size of the defaultdb folder?

New Member

Hello everyone,

I'm fairly new to Splunk and currently have the issue where the Splunk server is above 93% disk utilization due to the splunk defaultdb folder. My question is: Is there some maintenance steps or best practice items for managing the size?

alt text

0 Karma


Yes, there are best practices, but that is a pretty general question. You should start by understanding how Splunk stores indexes and how to configure them in general.

But since you may be in a disk space crisis, I would first examine the maximum size of the main index (that is what is stored in defaultdb). I would make sure that maximum size is not going to allow the index to grow any larger. All of this can be done from the Splunk GUI under Settings.

Take a look at the documentation here: Manage Index Storage

You have many choices in configuring indexes, including both size and location of the various components. If this post doesn't answer your question, then please refine the question. What do you want to do? Make the index smaller, move it to a different disk drive, split it between drives, set a retention policy to remove older data, etc. Then the community can give you better advice.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!