You only have "enough space in [y]our index" if there is enough disk space
Splunk rolls data on the following conditions:
- maximum index size reached
- maximum retention reached
- out of disk space
If you run out of disk space, Splunk starts rolling data out of Hot/Warm into Cold (or, out of Cold into Frozen) as it sees fit – it’s not entirely predictable as to what will be rolled first
To mitigate against disk space being your rolling condition you can either:
- shrink the maximum sizes of all indices using that storage point
- add disk space
from User warren – Stack Overflow https://stackoverflow.com/questions/76897166/splunk-data-trim/76898782#76898782
via IFTTT