Hi @riqbal47010,
it's allocated at the index creation time but it's possible to change also in a second time (and many times), but it isn't dinamic (not allocated based on index utilization).
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf .
Hi @riqbal47010,
it's allocated at the index creation time but it's possible to change also in a second time (and many times), but it isn't dinamic (not allocated based on index utilization).
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf .
So in cluster environment, I create some Indexes for POC products. like recorded future. I created one index for recorded future at the time of POC. after that I am not receiving the data even the data that I received passed its retention policy. it was written to Archive. Now that index has zero events.
how can I reclaim my disk space back.
Hi @riqbal47010,
if your index is present in one indexes.conf file, managed by the Master Node, you can use it: you haven't to reclaim your disk space back.
If not, you have to ask to the Splunk admin to rebuild it.
