Splunk Search

How do I fix low disk space in Enterprise indexer?

Fields29
New Member

How do I fix low disk space in enterprise indexer.

Please comment back on how to fix.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are two ways: 1) Add more disks; 2) delete some data.

There are many ways to reduce disk space use.  If the $SPLUNK_DB space is shared with the OS or $SPLUNK_HOME (both bad ideas) then use the du utility to determine what is using up disk space and correct as necessary.

Check for old bundles and delete them.

You'll get the most return, however, by reducing indexed data.  Reduce the frozenTimePeriodInSecs setting (it defaults to 7 years) for one or more of your indexes and restart the indexer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...