Monitoring Splunk

What is a simple way to clear some space if I'm running out of disk space allocated for indexes?

Ultra Champion

The indexes almost consumed the entire terabyte of space allocated for them. What would be a simple way to clear some space?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here.

http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy

View solution in original post

SplunkTrust
SplunkTrust

The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here.

http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy

View solution in original post

Ultra Champion

You are absolutely right -

We see -

234G _internaldb
14G _introspection

Can we handle them like any other index?

0 Karma

SplunkTrust
SplunkTrust

Yes, the indexes.conf for these internal indexes will available in $SPLUNK_HOME/etc/system/default. DO NOT UPDATE that copy. Instead create an indexes.conf in $SPLUNK_HOME/etc/system/local OR any app to update the stanza for _internal and _introspection indexes.

0 Karma

Ultra Champion

Makes perfect sense - much appreciated.

0 Karma