We are running out of disk space on one of our indexers on our SAN disk. We adjusted the maxTotalDataSizeMB and restarted but the index is still growing (we expected it to shrink to below maxTotalDataSizeMB). It has been up for about an hour.
asked 29 Nov '10, 15:57
Please log a support case if this has not been already done. Support would need to review the configuration settings for that indexer. In the meanwhile, the following link is a good reference
answered 29 Nov '10, 16:41
There are other indexes besides the default index - are you sure the current size is just of the default index or of the entire data store?
Keep in mind that Splunk will never age anything out of the thawedPath.
Also, I don't see any indication that you are controlling the number of warm buckets. By default, Splunk will keep 300 warm buckets in the homePath.
Do you see any buckets with the suffix "inflight" attached to them?
answered 29 Nov '10, 16:39