Splunk Search

Lacking Diskspace on /Splunkidx

thiliphk
New Member

How do we determine the need for increasing diskspace on /Splunkidx. Do we have any formula ?

Tags (4)
0 Karma

yannK
Splunk Employee
Splunk Employee

The amount of disk space needed for the indexes= sum of all the maxTotalDataSizeMB of all the indexes + 2GB safety.

If you are using the Volume option, read this http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstoragesize

If you are splitting the indexes homePath and ColPath in different partitions, see this http://wiki.splunk.com/Deploy:BucketRotationAndRetention
and http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Usemultiplepartitionsforindexdata

the formula for the space used by one index on each location is :

homePath total size =(maxWarmDBCount + maxHotBuckets ) * maxDataSize

coldPath total size = maxTotalDataSizeMB - "size of the hot+warm+cold buckets"

If you also have $SPLUNK_HOME on the same partition, do not forget to account for the dispatch folder (depends of the roles, usually 100MB per user + 500MB per power user + 10000MB per admin) (see authorize.conf)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...