Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- What is a simple way to clear some space if I'm ru...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The indexes almost consumed the entire terabyte of space allocated for them. What would be a simple way to clear some space?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here.
http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The simplest way would be to assign appropriate data retention policies on you indexes either by age of data or total size of the index. See more information here.
http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Setaretirementandarchivingpolicy
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are absolutely right -
We see -
234G _internaldb
14G _introspection
Can we handle them like any other index?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, the indexes.conf for these internal indexes will available in $SPLUNK_HOME/etc/system/default. DO NOT UPDATE that copy. Instead create an indexes.conf in $SPLUNK_HOME/etc/system/local OR any app to update the stanza for _internal and _introspection indexes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Makes perfect sense - much appreciated.
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
