Splunk Diskspace Usage

[Mkbell35]

How do we manage the diskspace usage by splunk.

1. Does it get truncate at x number of days?
2. Do we need to setup an alert the monitor the splunk logs too?

[Converted to question from answer on this question]

[Drainy · Accepted solution]

This docs post explains it all pretty well;
http://docs.splunk.com/Documentation/Splunk/latest/admin/Setaretirementandarchivingpolicy

Essentially Splunk stores data in hot, warm and cold buckets and then eventually turns to a frozen state. You can define the time between these changes in seconds or size of the buckets. Frozen is a state where you can either choose to run a script to archive and move your oldest data, perhaps to external storage, or (by default) just have it deleted. This way you can configure your data to age out after a certain period of time.

You can set up alerts to monitor Splunk logs too if you really want, the alerting is only available in the trial Enterprise license or on a fully licensed Enterprise system. There is also an app called SoS which is available here that can help you monitor and analyse Splunk problems or errors. Bundled with Splunk is an app called the deployment monitor that you can also activate to help monitor your license usage.

Have a read of the link and pop back if you find you have any specific questions.

[Mkbell35]

Thanks so much for your help well explained and to your offers.