Set limits on disk usage

Set limits on disk usage

There are several methods for controlling disk space used by Splunk. Most disk space will be used by Splunk's indexes, which include the compressed raw data. If you run out of disk space, Splunk will stop indexing. You can set a minimum free space limit to control how low you will let free disk space fall before indexing stops. Indexing will resume once space exceeds the minimum.

Set minimum free disk space

You can set a minimum amount of space to keep free on the disk where indexed data is stored. If the limit is reached, splunkd stops operating. Both indexing and searching are affected:

• Periodically, splunkd will check space on all partitions that contain splunk indexes. If the free disk space limit has been reached on any of those partitions, splunkd stops indexing data until more space is available. A UI banner and splunkd warning are posted to indicate the need to clear more disk space.
• Before attempting to launch a search, Splunk will require this amount of free space on the filesystem where the dispatch directory is stored, $SPLUNK_HOME/var/run/splunk/dispatch

The default minimum free disk space is 2000MB.

Note:

• Splunk will not clear any of its own disk space with this method. It will simply pause for more space to become available.
• Events can be lost if they are not written to a file during such a pause.

You can set minimium free disk space through Splunk Web, the CLI, or the server.conf configuration file.

In Splunk Web

• Click Manager in the upper right corner of Splunk Web.
• Click System settings.
• Under the Index settings section, find Pause indexing if free disk space (in MB) falls below::

• Enter your desired minimum free disk space in megabytes.
• Click Save.

Restart Splunk for your changes to take effect.

From the command line interface (CLI)

You can set the minimum free disk space via Splunk's CLI. To use the CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. Here, you set the minimum free disk space to 20,000MB (20GB):

# splunk set minfreemb 20000

# splunk restart

In server.conf

You can also set the minimum free disk space in the server.conf file. The relevant stanza/attribute is this:

[diskUsage]
minFreeSpace = <num>

Note that <num> represents megabytes. The default is 2000.

Control database storage

The indexes.conf file contains index configuration settings. You can control disk storage usage by specifying maximum index size or maximum age of data. When one of these limits is reached, the oldest indexed data will be deleted (the default) or archived. You can archive the data by using a predefined archive script or creating your own.

For detailed instructions on how to use indexes.conf to set maximum index size or age, see "Set a retirement and archiving policy".

For information on creating archive scripts, see "Archive indexed data".

For detailed information on index storage, see "How Splunk stores indexes".

• Was this topic useful?
• Post a comment