Splunk Search

Lacking Diskspace on /Splunkidx

thiliphk
New Member

How do we determine the need for increasing diskspace on /Splunkidx. Do we have any formula ?

Tags (4)
0 Karma

yannK
Splunk Employee
Splunk Employee

The amount of disk space needed for the indexes= sum of all the maxTotalDataSizeMB of all the indexes + 2GB safety.

If you are using the Volume option, read this http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstoragesize

If you are splitting the indexes homePath and ColPath in different partitions, see this http://wiki.splunk.com/Deploy:BucketRotationAndRetention
and http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Usemultiplepartitionsforindexdata

the formula for the space used by one index on each location is :

homePath total size =(maxWarmDBCount + maxHotBuckets ) * maxDataSize

coldPath total size = maxTotalDataSizeMB - "size of the hot+warm+cold buckets"

If you also have $SPLUNK_HOME on the same partition, do not forget to account for the dispatch folder (depends of the roles, usually 100MB per user + 500MB per power user + 10000MB per admin) (see authorize.conf)

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...