disk space allocation for newly created index

[riqbal47010]

will at the time of index creation the defined disk size allocated once. or it is allocated based on index utilization.

[gcusello · Accepted solution]

Hi @riqbal47010,
it's allocated at the index creation time but it's possible to change also in a second time (and many times), but it isn't dinamic (not allocated based on index utilization).
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf .

Ciao.
Giuseppe

[riqbal47010]

So in cluster environment, I create some Indexes for POC products. like recorded future. I created one index for recorded future at the time of POC. after that I am not receiving the data even the data that I received passed its retention policy. it was written to Archive. Now that index has zero events.
how can I reclaim my disk space back.

[gcusello]

Hi @riqbal47010,
if your index is present in one indexes.conf file, managed by the Master Node, you can use it: you haven't to reclaim your disk space back.
If not, you have to ask to the Splunk admin to rebuild it.

Ciao.
Giuseppe