Total Space For SplunkDB

Question

Hi,

Now I know you can set the following in indexes.conf maxTotalDataSizeMB = 500000 which sets the max size of the DB on a per index basis?

However if you have say 3 or 4 indexes is there a way to set the maxDB size on the DB level i.e. not on the index level for all your indexes together?

Regards, Josh

Answer 1

1

There currently is not. We expect to have options for defining server-wide per-volume space limits for indexes.conf in version 4.2, which will be able to accomplish what you want.

link

answered 16 Sep '10, 22:09

gkanapathy ♦
32.4k●4●8●27
accept rate: 41%

edited 17 Sep '10, 02:04

Any chance this will also apply to bucket rotation? Having the ability to roll older buckets to cold/frozen based on free disk space would be a huge win. – southeringtonp 0 secs ago

(17 Sep '10, 02:16) southeringtonp ♦

It will apply to hot and cold partitions also.

(17 Sep '10, 02:26) gkanapathy ♦

Cool looking forward to 4.2 :-), we have quite a few indexes now due to the way we partition data for different user groups. Would be good to be able to set this max globally so we know we can never run out of disk space, imagine running out of disk space on a splunk server... now that wouldnt look goood would it!

(20 Sep '10, 20:29) Josh

Answer 2

0

It is possible to set a global value for all indexes in a single instance of Splunk. In fact, that is what the maxTotalDataSizeMB parameter does in $SPLUNK_HOME/etc/system/default/indexes.conf. You can override this per index by putting maxTotalDataSizeMB inside the index declaration. For example,

# set global parameter value
maxTotalDataSizeMB = 500000

[myindex]
# override here
maxTotalDataSizeMB = 1000000

But there is no way to specify groups and set the db size per group.

link

answered 16 Sep '10, 19:41

hulahoop ♦
2.6k●14●11●51
accept rate: 40%

This does not set a global default for the combined size. It sets the default value for each index for which the maxTotalDataSize is otherwise unspecified.

(16 Sep '10, 22:08) gkanapathy ♦

Yes, sorry if that was not clear.

(16 Sep '10, 22:26) hulahoop ♦

Answer 3

1	Hi, i think there is no configurable way to do that because each index is it's own Database. link answered 16 Sep '10, 11:47 Christian 73●1●1●8 accept rate: 22%

Total Space For SplunkDB

Follow this question

Splunk Resources

Related questions