Mastering Splunk

Hitting the limits

We've discussed many topics concerning the management of the space that Splunk indexes consume. Of the space that Splunk uses, its indexes consume most of the space. Once you've implemented a strategy for index space management, you will still need to keep monitoring it (and perhaps amending it) as once the available disk space drops below the minimum allowed limit, Splunk indexing and searching will stop (don't worry though, Splunk will resume once space is freed up).

We'll talk some more about how to determine potential space needs a little later, but for now, consider the following factoids:

• Splunk routinely looks for free disk space on all the partitions that contain indexes. If the free disk space limit has been reached, ...