indexer reached disk space

[sarit_s]

Hello,

In one of out indexer we reached disk space in /var

this is the path that takes all the space:
opt/splunk/var/lib/splunk/prod/datamodel_summary

can i delete the files there ?

how can i avoid this messages ?

if it is not possible to remove them, what will be the best step in order to fix this issue ?

also, how is it possible that it happens only in one indexer while i have indexer cluster with 3 peers? 

thanks

sarit

[scelikok]

Hi @sarit_s,

This path keeps DataModel summary for prod index. Please check your accelerated data models which uses this prod index. In order to save disk space your can decrease acceleration time, i.e. if it is -1y, you can change to -6m or -3m depends on your needs. 

Another option is Rebalancing data in indexers from Cluster Master.

You should also check your event distribution between indexers. This problem shows your data sources for prod index somehow sending more data to this indexer. If these are Universal Forwarders, you can lower auto load balance setting to lower value and enable line breaker setting.

You can use information on below link;

https://lantern.splunk.com/hc/en-us/articles/1500000292062-Improving-event-distribution