Getting Data In

[Blog] Differentiate various size related parameters from indexes.conf

VatsalJagani
Champion

[Blog Post] Differentiate various size related parameters from indexes.conf

  • maxTotalDataSizeMB
  • maxGlobalRawDataSizeMB
  • maxGlobalDataSizeMB
  • maxDataSize
  • maxVolumeDataSizeMB
Labels (1)
1 Solution

VatsalJagani
Champion

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

View solution in original post

0 Karma

VatsalJagani
Champion

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...