Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Splunk Enterprise version 9.0 will no longer be supported as of June 14, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Set limits on disk usage

Note: This topic is not relevant to SmartStore indexes. See Initiate eviction based on occupancy of the cache's disk partition for information on how SmartStore controls local disk usage.

Splunk Enterprise uses several methods to control disk space. Indexes consume most of the disk space. If you run out of disk space, the indexer stops indexing. You can set a minimum free space limit to control how low free disk space falls before indexing stops. Indexing resumes once space exceeds the minimum.

Note: To determine how much space you need for your indexes, see "Estimate your storage requirements" in the Capacity Planning Manual.

Set minimum free disk space

You can set a minimum amount of free disk space for the disk where indexed data is stored. If the limit is reached, the indexer stops operating. Both indexing and searching are affected:

  • Periodically, the indexer checks space on all partitions that contain indexes. If the free disk space limit has been reached on any of those partitions, the indexer stops indexing data until more space is available. A UI banner and splunkd warning are posted to indicate the need to clear more disk space.
  • Before attempting to launch a search, the indexer requires that the specified amount of free space be available on the file system where the dispatch directory is stored, $SPLUNK_HOME/var/run/splunk/dispatch

The default minimum free disk space is 5000MB.

Note:

  • The indexer does not clear any of its disk space with this method. It simply pauses until more space becomes available.
  • Incoming data can be lost while indexing is suspended.

You can set minimium free disk space through Splunk Web, the CLI, or the server.conf configuration file.

In Splunk Web

To specify minimum disk usage in Splunk Web:

1. Click Settings in the upper right portion of Splunk Web.

2. Click Server settings.

3. Click General settings.

4. Under the Index settings section, set the field Pause indexing if free disk space (in MB) falls below to the desired minimum free disk space in megabytes.

5. Click Save.

6. Restart the indexer for your changes to take effect.

From the command line interface (CLI)

You can set the minimum free disk space with the CLI. This example sets the minimum free disk space to 20,000MB (20GB):

splunk set minfreemb 20000
splunk restart

For information on using the CLI, see "About the CLI" in the Admin manual.

In server.conf

You can also set the minimum free disk space in the server.conf file. The relevant stanza/attribute is this:

[diskUsage]
minFreeSpace = <num>

Note that <num> represents megabytes. The default is 5000.

Control index storage

The indexes.conf file contains index configuration settings. You can control disk storage usage by specifying maximum index size or maximum age of data. When one of these limits is reached, the oldest indexed data will be deleted (the default) or archived. You can archive the data by using a predefined archive script or creating your own.

For detailed instructions on how to use indexes.conf to set maximum index size or age, see "Set a retirement and archiving policy".

For detailed information on index storage, see "How the indexer stores indexes".

Last modified on 03 October, 2018
Configure maximum index size   Reduce tsidx disk usage

This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters