Getting Data In

[Blog] Differentiate various size related parameters from indexes.conf

VatsalJagani
Champion

[Blog Post] Differentiate various size related parameters from indexes.conf

  • maxTotalDataSizeMB
  • maxGlobalRawDataSizeMB
  • maxGlobalDataSizeMB
  • maxDataSize
  • maxVolumeDataSizeMB
Labels (1)
1 Solution

VatsalJagani
Champion

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

View solution in original post

0 Karma

VatsalJagani
Champion

indexes.conf.spect should give acurate answer - https://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf 

But here I'm trying to summarize in one-liners.

  • maxTotalDataSizeMB
    • How large an Index can grow. (default ~500GB)
  • maxGlobalRawDataSizeMB
    • How large an Index's _raw data (uncompressed size) can grow. This is only valid for remote-storage-enabled indexes. (default - unlimited)
  • maxGlobalDataSizeMB
    • How large an Index can grow in Smart Store (default - unlimited)
  • maxDataSize
    • Maximum allowed size of a bucket (does not apply to older buckets that are already there) (default - auto ~750 MB)
  • maxVolumeDataSizeMB
    • Maximum allowed size of a volume. (no default)
  • homePath.maxDataSizeMB
    • Maximum allowed size of home path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/db)
  • coldPath.maxDataSizeMB
    • Maximum allowed size of cold path. (default - $SPLUNK_HOME/var/lib/splunk/<index>/colddb)

 

Whichever storage limit reaches the first the oldest bucket will get impacted (moved/deleted depending on which parameter it is and what policies are configured.) For details please read indexes.conf.spec.

 

I've covered only size related, there are also a number of buckets-related parameters.  Though I may come back in the future and update the answer to include a one-liner description for bucket count-related useful parameters.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...