How do I "enable" iplocation in Splunk Ent. 6.2.2. I thought it might be just an automatic function now that the database is default. When I try searches using "iplocation" context it brings up nothing. Any help would be greatly appreciated as I can find details on this anywhere. Note, I have a cluster environment with two peers and another server acting as the master/search head. Thanks in advance. ... View more

I have setup a Windows 2008 virtual machine with the latest Splunk version installed. I only have a total of 10 gig on the volume that Splunk is installed. I would like it to roll over (delete) after the database hits approx 8-8.5 gig of data. Is there any easy way to do this? I've looked into the index's and it appears to use the main db and the _internal the most. Do I have to set each of these to 4 GB each or is there another more straight forward way to do this? Or, do I set the maxTotalDataSizeMB to 8000 mb? Any info. would be greatly appreciated. ... View more