Splunk Search

Lacking Diskspace on /Splunkidx

thiliphk
New Member

How do we determine the need for increasing diskspace on /Splunkidx. Do we have any formula ?

Tags (4)
0 Karma

yannK
Splunk Employee
Splunk Employee

The amount of disk space needed for the indexes= sum of all the maxTotalDataSizeMB of all the indexes + 2GB safety.

If you are using the Volume option, read this http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstoragesize

If you are splitting the indexes homePath and ColPath in different partitions, see this http://wiki.splunk.com/Deploy:BucketRotationAndRetention
and http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Usemultiplepartitionsforindexdata

the formula for the space used by one index on each location is :

homePath total size =(maxWarmDBCount + maxHotBuckets ) * maxDataSize

coldPath total size = maxTotalDataSizeMB - "size of the hot+warm+cold buckets"

If you also have $SPLUNK_HOME on the same partition, do not forget to account for the dispatch folder (depends of the roles, usually 100MB per user + 500MB per power user + 10000MB per admin) (see authorize.conf)

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...