how to limit _internal and _audit indexes capabilities in splunk ? why these indexes are taking large space compare to user index data ?

[appensure]

how to limit _internal and _audit indexes capabilities in splunk ? why these indexes are taking large space compare to user index data ?

[lukejadamec]

Generally the logs will take up a max of 125MB each because they keep 4 rolled files each and have a max size of 24MB each.

Normally, they don't get that large unless there is a problem, or the system has been installed for a long time.

It is possible that the logging levels are not at the defaults. If you want to view or change the logging levels and or set the max log file size for the various Splunk processes you can do it in the splunk/etc/log.cfg

You can also set them from Splunkweb at Manager>System Settings> System Logging.

[sowings]

Note that they don't count against your license usage.