Now I know you can set the following in indexes.conf maxTotalDataSizeMB = 500000 which sets the max size of the DB on a per index basis?
However if you have say 3 or 4 indexes is there a way to set the maxDB size on the DB level i.e. not on the index level for all your indexes together?
It is possible to set a global value for all indexes in a single instance of Splunk. In fact, that is what the maxTotalDataSizeMB parameter does in $SPLUNK_HOME/etc/system/default/indexes.conf. You can override this per index by putting maxTotalDataSizeMB inside the index declaration. For example,
But there is no way to specify groups and set the db size per group.
answered 16 Sep '10, 19:41
Hi, i think there is no configurable way to do that because each index is it's own Database.
answered 16 Sep '10, 11:47