We've discussed many topics concerning the management of the space that Splunk indexes consume. Of the space that Splunk uses, its indexes consume most of the space. Once you've implemented a strategy for index space management, you will still need to keep monitoring it (and perhaps amending it) as once the available disk space drops below the minimum allowed limit, Splunk indexing and searching will stop (don't worry though, Splunk will resume once space is freed up).
We'll talk some more about how to determine potential space needs a little later, but for now, consider the following factoids:
Splunk routinely looks for free disk space on all the partitions that contain indexes. If the free disk space limit has been reached, Splunk stops.
Before executing a Splunk search, the amount of free space available is checked. If the free disk space limit has been reached, Splunk does not execute the search.
By default, the minimum free disk space required is 5,000 MB.
Splunk does...