Manage namespace file size

In the Splunk App for VMware tsidx files are stored in namespaces on the search head. You can manage the size of the tsidx namespace files using a retention policy. A retention policy specifies a limit for the size of the tsidx namespaces created and the length of time that namespaces are retained in your environment.

The $SPLUNK_HOME/etc/apps/SA-Utils/default/tsidx_retention.conf file specifies the default retention policy for all namespaces. The default retention time period is 2,184 days. If you do not create specific retention policies for individual namespaces, then the app uses the default value specified in SA-utils, for all namespaces that do not have one specifically defined.

Set up a retention policy for specific namespaces

To set a policy for each of the specific namespaces, create a $SPLUNK_HOME/etc/apps/<add-on-name>/local/tsidx_retention.conf file in each of the namespaces and configure the settings.

Set up a retention policy

1. Create a $SPLUNK_HOME/etc/apps/SA-VMW-Performance/local/tsidx_retention.conf file.
2. Edit the tsidx_retention.conf file to uncomment the namespaces that you want to use in the app.
3. Change the values associated with those namespaces.
• You can use the default values for the namespaces or modify the settings to values that work in your environment.

Clean up tsidx namespace files

To reclaim space used by tsidx files, the app runs a script that cleans up the tsidx namespaces. How the files are cleaned up depends on the retention policy defined for the namespace in the $SPLUNK_HOME/etc/apps/SA-VMW-Performance/default/tsidx_retention.conf file.

TSIDX cleanup based on the file size cleans all tsidx files, but always leaves one file in that namespace. If you do not want to have one large tsidx file in the namespace, you can change the the maximum allowed size for the tsidx files.

Change the the maximum allowed size for the tsidx files:

1. Open the $SPLUNK_HOME/etc/system/local/limit.conf file.
2. Change the value of the parameter optimize_max_size_mb to specify a size limit for a single tsidx file.
3. Restart Splunk Enterprise.