Monitoring Splunk

disk space allocation for newly created index

riqbal47010
Path Finder

will at the time of index creation the defined disk size allocated once. or it is allocated based on index utilization.

Labels (2)
0 Karma
1 Solution

gcusello
Legend

Hi @riqbal47010,
it's allocated at the index creation time but it's possible to change also in a second time (and many times), but it isn't dinamic (not allocated based on index utilization).
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf .

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi @riqbal47010,
it's allocated at the index creation time but it's possible to change also in a second time (and many times), but it isn't dinamic (not allocated based on index utilization).
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf .

Ciao.
Giuseppe

0 Karma

riqbal47010
Path Finder

So in cluster environment, I create some Indexes for POC products. like recorded future. I created one index for recorded future at the time of POC. after that I am not receiving the data even the data that I received passed its retention policy. it was written to Archive. Now that index has zero events.
how can I reclaim my disk space back.

0 Karma

gcusello
Legend

Hi @riqbal47010,
if your index is present in one indexes.conf file, managed by the Master Node, you can use it: you haven't to reclaim your disk space back.
If not, you have to ask to the Splunk admin to rebuild it.

Ciao.
Giuseppe

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>