/u/rduken offers one solid solution – using configuration limts for individual indices
Another option is to use user quotas on the splunk user. If you set a cap of, say, 65GB (to account for app overhead), you can also limit how much Splunk can catalogue – https://www.linux.com/learn/step-step-using-user-quotas-linux
August 12, 2019 at 01:11PM
via reddit https://www.reddit.com/r/Splunk/comments/co4oka/newb_splunk_sizing_question/ewoz30c?utm_source=ifttt