Splunk® App for VMware

Configuration Guide

Acrobat logo Download manual as PDF

On August 31, 2022, the Splunk App for VMware will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for VMware Dashboards and Reports.
This documentation does not apply to the most recent version of VMW. Click here for the latest version.
Acrobat logo Download topic as PDF

Manage namespace file size

In the Splunk App for VMware tsidx files are stored in namespaces on the search head. You can manage the size of the tsidx namespace files using a retention policy. A retention policy specifies a limit for the size of the tsidx namespaces created and the length of time that namespaces are retained in your environment.

The $SPLUNK_HOME/etc/apps/SA-Utils/default/tsidx_retention.conf file specifies the default retention policy for all namespaces. The default retention time period is 2,184 days. If you do not create specific retention policies for individual namespaces, then the app uses the default value specified in SA-utils, for all namespaces that do not have one specifically defined.

Set up a retention policy for specific namespaces

To set a policy for each of the specific namespaces, create a $SPLUNK_HOME/etc/apps/<add-on-name>/local/tsidx_retention.conf file in each of the namespaces and configure the settings.

Set up a retention policy

  1. Create a $SPLUNK_HOME/etc/apps/SA-VMW-Performance/local/tsidx_retention.conf file.
  2. Edit the tsidx_retention.conf file to uncomment the namespaces that you want to use in the app.
  3. Change the values associated with those namespaces.
    • You can use the default values for the namespaces or modify the settings to values that work in your environment.

Clean up tsidx namespace files

To reclaim space used by tsidx files, the app runs a script that cleans up the tsidx namespaces. How the files are cleaned up depends on the retention policy defined for the namespace in the $SPLUNK_HOME/etc/apps/SA-VMW-Performance/default/tsidx_retention.conf file.

TSIDX cleanup based on the file size cleans all tsidx files, but always leaves one file in that namespace. If you do not want to have one large tsidx file in the namespace, you can change the the maximum allowed size for the tsidx files.

Change the the maximum allowed size for the tsidx files:

  1. Open the $SPLUNK_HOME/etc/system/local/limit.conf file.
  2. Change the value of the parameter optimize_max_size_mb to specify a size limit for a single tsidx file.
  3. Restart Splunk Enterprise.
Last modified on 31 July, 2015
Namespaces used in Splunk App for VMware
Storage requirements for tsidx namespaces

This documentation applies to the following versions of Splunk® App for VMware: 3.1.1, 3.1.2, 3.1.3, 3.1.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters