There are two ways: 1) Add more disks; 2) delete some data.
There are many ways to reduce disk space use. If the $SPLUNK_DB space is shared with the OS or $SPLUNK_HOME (both bad ideas) then use the du utility to determine what is using up disk space and correct as necessary.
Check for old bundles and delete them.
You'll get the most return, however, by reducing indexed data. Reduce the frozenTimePeriodInSecs setting (it defaults to 7 years) for one or more of your indexes and restart the indexer.
---
If this reply helps you, Karma would be appreciated.
