@jiaminyun To configure Splunk to limit an index to 80% of its maximum size and prevent further data from being written. Define the maximum size for your index in the indexes.conf file using the ma...
See more...
@jiaminyun To configure Splunk to limit an index to 80% of its maximum size and prevent further data from being written. Define the maximum size for your index in the indexes.conf file using the maxTotalDataSizeMB attribute. For example, if you want the maximum size to be 100 GB [your_index_name]
maxTotalDataSizeMB = 102400 To enforce the 80% limit, you can use the maxVolumeDataSizeMB attribute within a volume configuration. This attribute specifies the maximum size for the volume, and you can set it to 80% of the total size. For example, if the total size is 100 GB, set the volume size to 80 GB [volume:your_volume_name]
path = /path/to/your/volume
maxVolumeDataSizeMB = 81920 Configure maximum index size - Splunk Documentation