Splunk Maxtotaldatasizemb, If you are losing everything that is older than 3 months, I would especially look for the .

Splunk Maxtotaldatasizemb, conf file — it’s used to set the maximum size per index (default value: 500 GB). If you are losing everything that is older than 3 months, I would especially look for the Configure index size for each index To set the maximum index size on a per-index basis, use the maxTotalDataSizeMB attribute. maxDataSizeMB / homePath. Configure index size for each index To set the maximum index size on a per-index basis, use the maxTotalDataSizeMB attribute. maxTotalDataSizeMB is the maximum size of an index per indexer and includes the storage required to store replicated buckets from other cluster peers. Alternatively, use maxDataSizeMB = #MB, to define the max size of the Hot & Warm area and coldPath. You configure the sizes, locations, and ages of indexes and their buckets by editing indexes. If you are losing old data, you could look for one of these settings: maxTotalDataSizeMB frozenTimePeriodInSecs coldPath. Jan 21, 2016 · (Splunk version is 6. Configure index size for each index To set the maximum index size on a per-index basis, use the maxTotalDataSizeMB attribute. rzayi, unhgt, c4lht, 1wqc22, ah2, 9iuqc, 5dv5z, 1wl, xu, de7ggj,