Documentation: 3.0.2
|  Print Version Contents
This page last updated: 10/09/07 12:10pm

Change data policy to recover space

You can edit indexes.conf to set different index space policies. First, copy indexes.conf from $SPLUNK_HOME/etc/bundles/default/ into $SPLUNK_HOME/etc/bundles/local/. This page is well-commented, and divided into different sections for each database. The section at the top sets global preference that apply to all indexes:

sync = 0
maxQueryIds = 10000000
defaultDatabase = main
queryLanguageDefinition = $SPLUNK_HOME/etc/searchLanguage.xml

maxWarmDBCount = 300
maxColdDBCount = 10
frozenTimePeriodInSecs = 188697600
rotatePeriodInSecs = 60
maxDataSize = 750
maxTermChars = 2097152
maxTerms = 131072
maxPostings = 2097152
maxValues = 65536
coldToFrozenScript = echo $DIR
compressRawdata = true
maxTotalDataSizeMB = 500000
indexThreads = 0
maxMemMB = 50

This conf file is set to optimize space and memory. However, if you want to set up Splunk to use less space on your server, you can change the following fields:

You can set maxTotalDataSizeMB to a smaller amount. This will age out your indexes sooner.

Changing frozenTimePeriodInSecs determines how long your cold DBs persist on your Splunk Server. If you have data you do not want to keep around very long, you can set this value lower.

Set the coldToFrozenScript to a script you have written if you want to archive your data -- eg to a datastore or SAN.

The rest of this file is set for memory optimization. If you have any questions, please contact Splunk Support for help editing this file.

Previous: Move an index    |    Next: Anonymize data samples

Comments

  1. Thanks Scott, those paths were from the 2.x configuration structure.. I've corrected the offending paths.
    Posted by m@ on Oct 01 2007, 2:11pm

  2. The first sentence should be changed what is below - the path is incorrect.

    You can edit indexes.conf to set different index space policies. First, copy indexes.conf from $SPLUNK_HOME/etc/bundles/default/ into $SPLUNK_HOME/etc/bundles/local/.
    Posted by scottprigge on Oct 01 2007, 1:53pm

Log in to comment.