Book Image

Mastering Splunk

By : James D. Miller
Book Image

Mastering Splunk

By: James D. Miller

Overview of this book

Table of Contents (18 chapters)
Mastering Splunk
About the Author
About the Reviewers

Size matters

When it comes to the sizing of indexes, it is important to allow appropriate extra or buffer space as Splunk, during normal processing, can sporadically exceed indexes' set maximum size. Again, configuring the sizes of indexes is done by editing the indexes.conf file.

Index-by-index attributes

You can set index sizes (using the maxTotalDataSizeMB attribute) in the indexes.conf file based on your knowledge of the data.

Bucket types

Index sizing can also be done using bucket types. A bucket is a location or folder on a disk that contains all or parts of a Splunk index. You can set a maximum size for all hot and warm buckets using the following syntax:

homePath.maxDataSizeMB = 10000 

To set the maximum size for all cold bucket storage, you can use the following syntax:

coldPath.maxDataSizeMB = 5000


Finally, a popular method used to organize and direct index sizes is through the use of volumes. A volume is basically the disk space that is set aside for a particular use and in this...