search

zappee / docker-images

Build file of Docker images (WebLogic, Tomcat, etc.)
6 stars 1 forks source link

Disk usage of the splunk indexes is not set properly #4

Closed zappee closed 2 years ago

zappee commented 2 years ago

Splunk running in docker can consume unlimited disk space and that can cause a disk full on the host machine where the Splunk container runs. The index size of the Splunk must be limited properly.

zappee commented 2 years ago

This new configuration looks promising. That limits the size of the main index to 200MB and it also limits the size of the internal indexes.

[default]
maxTotalDataSizeMB=200
maxDataSize=200
coldToFrozenDir=
minHotIdleSecsBeforeForceRoll=0

[_internal]
maxDataSize=500

[_introspection]
maxDataSize=500

[_metrics]
maxDataSize=400

[main]
maxDataSize=200