Windows installation- retention question

[mbohlsen]

I have setup a Windows 2008 virtual machine with the latest Splunk version installed. I only have a total of 10 gig on the volume that Splunk is installed. I would like it to roll over (delete) after the database hits approx 8-8.5 gig of data. Is there any easy way to do this? I've looked into the index's and it appears to use the main db and the _internal the most. Do I have to set each of these to 4 GB each or is there another more straight forward way to do this? Or, do I set the maxTotalDataSizeMB to 8000 mb? Any info. would be greatly appreciated.

[jeff]

maxTotalDataSizeMB would be the total size, per index, so you would need to configure each of your indexes so that the sum of each maxTotalDataSizeMB was less than the amount of storage you wanted to allocate for Splunk's indexes. Depending on how much you are indexing outside of Splunk, it's not likely you will need 4GB for _internal (I have been indexing 15-20GB for nearly 9 months and my _internal index is ~3.5GB).

You may want to consider adding the following to your etc/system/local/indexes.conf

[default]
maxTotalDataSizeMB = 512

[main]
maxTotalDataSizeMB = 5120

There are other settings to play with too, including maxDataSize to control the size of each hot bucket and frozenTimePeriodInSecs to force migration to frozen (ie, purge unless you have a script to handle this) after a set time based retention.

See the documentation for indexes.conf at: http://www.splunk.com/base/Documentation/latest/admin/Indexesconf

[jeff]

If you changed it in the web interface, it is likely created an indexes.conf in $SPLUNK_HOME\etc\apps\search\local with your settings. I personally hate distributing settings in the application directories so I tend to edit the conf files directly under etc\system\local...

[mbohlsen]

Thanks for the information. I actually adjusted the "main" index size in the GUI and then restarted the Splunk server. I then checked the index.conf to see if it changed in the file. It did not. Should it reflect the change or if it's changed in the web interface does it store the info. somewhere else? Thanks in advance.