What is a simple way to clear some space if I'm running out of disk space allocated for indexes?

[ddrillic]

The indexes almost consumed the entire terabyte of space allocated for them. What would be a simple way to clear some space?

[somesoni2 · Accepted solution]

The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here.

http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy

[ddrillic]

You are absolutely right -

We see -

234G _internaldb
14G _introspection

Can we handle them like any other index?

[somesoni2]

Yes, the indexes.conf for these internal indexes will available in $SPLUNK_HOME/etc/system/default. DO NOT UPDATE that copy. Instead create an indexes.conf in $SPLUNK_HOME/etc/system/local OR any app to update the stanza for _internal and _introspection indexes.

[ddrillic]

Makes perfect sense - much appreciated.