Set limits on disk usage
Splunk Enterprise uses several methods to control disk space. Indexes consume most of the disk space. If you run out of disk space, the indexer stops indexing. You can set a minimum free space limit to control how low free disk space falls before indexing stops. Indexing resumes once space exceeds the minimum.
Note: To determine how much space you need for your indexes, see "Estimate your storage requirements" in the Capacity Planning Manual.
Set minimum free disk space
You can set a minimum amount of free disk space for the disk where indexed data is stored. If the limit is reached, the indexer stops operating. Both indexing and searching are affected:
- Periodically, the indexer checks space on all partitions that contain indexes. If the free disk space limit has been reached on any of those partitions, the indexer stops indexing data until more space is available. A UI banner and
splunkdwarning are posted to indicate the need to clear more disk space.
- Before attempting to launch a search, the indexer requires that the specified amount of free space be available on the file system where the dispatch directory is stored,
The default minimum free disk space is 5000MB.
- The indexer does not clear any of its disk space with this method. It simply pauses until more space becomes available.
- Incoming data can be lost while indexing is suspended.
You can set minimium free disk space through Splunk Web, the CLI, or the
server.conf configuration file.
In Splunk Web
To specify minimum disk usage in Splunk Web:
1. Click Settings in the upper right portion of Splunk Web.
2. Click Server settings.
3. Click General settings.
4. Under the Index settings section, set the field Pause indexing if free disk space (in MB) falls below to the desired minimum free disk space in megabytes.
5. Click Save.
6. Restart the indexer for your changes to take effect.
From the command line interface (CLI)
You can set the minimum free disk space with the CLI. This example sets the minimum free disk space to 20,000MB (20GB):
splunk set minfreemb 20000 splunk restart
For information on using the CLI, see "About the CLI" in the Admin manual.
You can also set the minimum free disk space in the server.conf file. The relevant stanza/attribute is this:
[diskUsage] minFreeSpace = <num>
<num> represents megabytes. The default is 5000.
Control index storage
The indexes.conf file contains index configuration settings. You can control disk storage usage by specifying maximum index size or maximum age of data. When one of these limits is reached, the oldest indexed data will be deleted (the default) or archived. You can archive the data by using a predefined archive script or creating your own.
For detailed instructions on how to use
indexes.conf to set maximum index size or age, see "Set a retirement and archiving policy".
For detailed information on index storage, see "How the indexer stores indexes".
Configure maximum index size
Determine which indexes.conf changes require restart
This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10