Splunk Enterprise

Splunk Indexer chewing up disk space

New Member

We have a 12 node Hadoop Cluster and we are using splunk to index all log files (Hbase, Cloudera Manager, Jobtracker, name node, and other assortments of logs). Currently our NAS device where we store all the splunk indexes is getting 100% full (df -h command show 100%).

How can we limit the disk space being used by Splunk indexing to 50 gigs. We have tried 'clean event data' but it filled up within a week.

Tags (1)
0 Karma


You can set the size of each Splunk index. When the index fills, the oldest data will automatically be rolled out (aka "frozen").

Go to the Splunk Manager and look at the maximum size set for each index. You should set this so that your disk space is not exceeded.

There is also a feature in Splunk that lets you create logical volumes for more detailed control of your disk space for indexes.

Read more in the documentation at Configure Index Size

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...