Size matters
When it comes to the sizing of indexes, it is important to allow appropriate extra or buffer space as Splunk, during normal processing, can sporadically exceed indexes' set maximum size. Again, configuring the sizes of indexes is done by editing the indexes.conf file.
Index-by-index attributes
You can set index sizes (using the maxTotalDataSizeMB attribute) in the indexes.conf file based on your knowledge of the data.
Bucket types
Index sizing can also be done using bucket types. A bucket is a location or folder on a disk that contains all or parts of a Splunk index. You can set a maximum size for all hot and warm buckets using the following syntax:
homePath.maxDataSizeMB = 10000
To set the maximum size for all cold bucket storage, you can use the following syntax:
coldPath.maxDataSizeMB = 5000
Volumes
Finally, a popular method used to organize and direct index sizes is through the use of volumes. A volume is basically the disk space that is set aside for a particular use and in this...
