Set limits on disk usage

Splunk Enterprise uses several methods to control disk space. Indexes consume most of the disk space. If you run out of disk space, the indexer stops indexing. You can set a minimum free space limit to control how low free disk space falls before indexing stops. Indexing resumes once space exceeds the minimum.

Note: To determine how much space you need for your indexes, see "Estimate your storage requirements" in the Capacity Planning Manual.

Set minimum free disk space

You can set a minimum amount of free disk space for the disk where indexed data is stored. If the limit is reached, the indexer stops operating. Both indexing and searching are affected:

• Periodically, the indexer checks space on all partitions that contain indexes. If the free disk space limit has been reached on any of those partitions, the indexer stops indexing data until more space is available. A UI banner and splunkd warning are posted to indicate the need to clear more disk space.
• Before attempting to launch a search, the indexer requires that the specified amount of free space be available on the file system where the dispatch directory is stored, $SPLUNK_HOME/var/run/splunk/dispatch

The default minimum free disk space is 5000MB.

Note:

• The indexer does not clear any of its disk space with this method. It simply pauses until more space becomes available.
• Incoming data can be lost while indexing is suspended.

You can set minimium free disk space through Splunk Web, the CLI, or the server.conf configuration file.

In Splunk Web

To specify minimum disk usage in Splunk Web:

1. Click Settings in the upper right portion of Splunk Web.

2. Click Server settings.

3. Click General settings.

4. Under the Index settings section, set the field Pause indexing if free disk space (in MB) falls below to the desired minimum free disk space in megabytes.

5. Click Save.

6. Restart the indexer for your changes to take effect.

From the command line interface (CLI)

You can set the minimum free disk space with the CLI. This example sets the minimum free disk space to 20,000MB (20GB):

splunk set minfreemb 20000
splunk restart

For information on using the CLI, see "About the CLI" in the Admin manual.

In server.conf

You can also set the minimum free disk space in the server.conf file. The relevant stanza/attribute is this:

[diskUsage]
minFreeSpace = <num>

Note that <num> represents megabytes. The default is 5000.

Control index storage

The indexes.conf file contains index configuration settings. You can control disk storage usage by specifying maximum index size or maximum age of data. When one of these limits is reached, the oldest indexed data will be deleted (the default) or archived. You can archive the data by using a predefined archive script or creating your own.

For detailed instructions on how to use indexes.conf to set maximum index size or age, see "Set a retirement and archiving policy".

For detailed information on index storage, see "How the indexer stores indexes".