Hi.
I have single server Splunk architecture. I create a index let's call it "IT" and storage pointed to 500GB of separate High performance SSD (not a default drive). No other index is stored on this storage. Initially i set the size of IT index to 200GB. Now, we need to index data more than 200GB i increase the size to 450GB from Indexes Web UI. now start ingesting data into index IT. Indexing seems to stop or current size doesn't grow beyond 300GB even tsthough there is 150GB space available.
Max Size of Entire Index = 500 GB
Max Size of Hot/Warm/Cold bucket = auto
I haven't setup Frozen path or Tsidx Retention Policy.
I can't figure out why it's not indexing data? I appreciate community's help or suggestion/s?
↧