Change data policy to recover space
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Change data policy to recover space
You can edit indexes.conf to set different index space policies. First, copy indexes.conf from $SPLUNK_HOME/etc/bundles/default/ into $SPLUNK_HOME/etc/bundles/local/. This page is well-commented, and divided into different sections for each database. The section at the top sets global preference that apply to all indexes:
sync = 0 maxQueryIds = 10000000 defaultDatabase = main queryLanguageDefinition = $SPLUNK_HOME/etc/searchLanguage.xml maxWarmDBCount = 300 maxColdDBCount = 10 frozenTimePeriodInSecs = 188697600 rotatePeriodInSecs = 60 maxDataSize = 750 maxTermChars = 2097152 maxTerms = 131072 maxPostings = 2097152 maxValues = 65536 coldToFrozenScript = echo $DIR compressRawdata = true maxTotalDataSizeMB = 500000 indexThreads = 0 maxMemMB = 50
This conf file is set to optimize space and memory. However, if you want to set up Splunk to use less space on your server, you can change the following fields:
You can set maxTotalDataSizeMB to a smaller amount. This will age out your indexes sooner.
Changing frozenTimePeriodInSecs determines how long your cold DBs persist on your Splunk Server. If you have data you do not want to keep around very long, you can set this value lower.
Set the coldToFrozenScript to a script you have written if you want to archive your data -- eg to a datastore or SAN.
The rest of this file is set for memory optimization. If you have any questions, please contact Splunk Support for help editing this file.
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4 View the Article History for its revisions.