Hi, I am currently setting up retention for an index, I want a retention period of 1 year where after that period the data will be deleted.
But worried about the data moving from hot/warm to cold...
Hi. I need to add some limits to retention in my indexes.conf file on several indexers.
The documentation suggests that the best place for the indexes.conf to reside is in $SPLUNK_HOME/etc/s...
Hey All,
I have a question surrounding the best way to deploy the indexes.conf in our environment.
We currently have our indexes.conf deployed to our indexers, heavy forwarders, and ES. We d...
I use Splunk Enterprise 8.0.4.1
In indexes.conf I have changed maxTotalDataSizeMB value.
According to https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Determinerestart&n...
Hello Splunkers, For a specific index I configured repFactor = auto and I suppose that the logs are exactly the same on my two indexers for this specific index. How could I verify that all bu...
I have installed search head cluster and want pushing configuration by deployment server . But unable to find how to make and push indexes.conf to all indexers ( not in clustering ) . Thanks for r...
[Blog Post] Differentiate various size related parameters from indexes.conf maxTotalDataSizeMB maxGlobalRawDataSizeMB maxGlobalDataSizeMB maxDataSize maxVolumeDataSizeMB
Hi guys,
I'm new to dealing with .conf files so I'm having a practice on my own home splunk instance. My goal is to try and create an index named "lapd" from indexes.conf and then upload a d...