About zpasplunk

zpasplunk · ‎01-23-2023

Yes I was suspecting frozenTimePeriodInSecs as well based on the docs.. Thx

zpasplunk · ‎01-23-2023

Ok so the buckets have gone up by 1 and the data has gone up by 2GB. It's already way over my new limit. It doesn't appear to be honoring that, is there some other way to force this?

zpasplunk · ‎01-20-2023

After setting this, and pushing the cluster bundle to all nodes (they restart), what else do I have to do to get old data purged? I have a 500GB index which I now have set maxTotalDataSizeMB for that index to 10GB. Does it happen automatically, or do I have to do something else to shrink it back down?

zpasplunk · ‎01-11-2023

We're not using LDAP, and these are local Splunk users.

zpasplunk · ‎01-10-2023

Anyone know what's going on here? It won't let me delete a local user. I can see them in the UI, but cannot manage them. I tried to delete via the CLI and this is what I get: $ sudo /opt/splunk/bin/splunk remove user test1 Attempted to delete a user that does not exist: test1 $ sudo /opt/splunk/bin/splunk list user | grep 'test1' username: test1

zpasplunk · ‎01-10-2023

I have a bunch of indexes, but one in particular I want to keep smaller. How do I do this? From the docs it looks like this could work? Adding maxTotalDataSizeMB to the index config? Anyknow know for sure? /opt/splunk/etc/master-apps/_cluster/local/indexes.conf: [webapp1] maxTotalDataSizeMB = <nonnegative integer> * The maximum size of an index (in MB). * If an index grows larger than the maximum size, the oldest data is frozen. * This parameter only applies to hot, warm, and cold buckets. It does not apply to thawed buckets. * CAUTION: This setting takes precedence over other settings like 'frozenTimePeriodInSecs' with regard.....

Posts	6
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎01-10-2023

Online Status	Offline
Date Last Visited	‎01-23-2023 04:19 PM

Managing users - deleting user says user does not ...

How to limit the max size of a single index?

Re: How to limit the max size of a single index?

Re: How to limit the max size of a single index?

Re: How to limit the max size of a single index?

Re: Managing users - deleting user says user does ...

Managing users - deleting user says user does not ...

How to limit the max size of a single index?