Solution Summary
1) Check data rentention setting at front end is wirking properly
2) Check and compare current index size and index size of initial setup
3) Compare no of devices in current and initial setup
Solution Steps In Detail
Check UI data retention for each index is working properly
Data retention should work as per data retention settings in data store module. Active data , Inactive data and Archived data, these details will provide number of days we want indices to be active,inactive or archived
Example:As mentioned in above image netflow data should be active for 10 days and archived for 30 days after that netflow index will be deleted automatically as per setting.
To validate data retention is working properly or not search netflow index in storage under data store module and verify number of active indices as well as archived indices as per setting are present.
If indices are not present as per data retention settings delete unwanted indices (Note:Validate each index as per retention settings.)
If all indices are present as per data retention settings, then issue may be with data polling got increased compare to initial settings (More devices are added in data sources which will increase number of polling documents).Compare older indices size with current indices size. And if Indices size is more then more disk space is required.
In sify TSL env index size was more compared to initial settings because of addition of more devices.
Nfs mount point storage wwas increased to accomodate pooling of more devices.
Mount point space usage should be kept less than 80%.
Use df -hT command to find mount point details.