https://community.splunk.com/t5/Getting-Data-In/When-the-maxVolumeDataSizeMB-for-the-primary-volume-is-exceeded/m-p/113182#M23683 <P>Hi,</P> <P>When the maxVolumeDataSizeMB for the primary volume is exceeded, will the events automatically roll over to the secondary volume? </P> <P>Here are my settings:</P> <P>[volume:primary]<BR /> path = /apps/splunk/db</P> <H1>500GB</H1> <P>maxVolumeDataSizeMB = 500000<BR /> [volume:secondary]<BR /> path = /apps/splunk/colddb</P> <H1># 5,000GB</H1> <P>maxVolumeDataSizeMB = 5000000</P> Wed, 05 Nov 2014 18:22:01 GMT a212830 2014-11-05T18:22:01Z https://community.splunk.com/t5/Getting-Data-In/When-the-maxVolumeDataSizeMB-for-the-primary-volume-is-exceeded/m-p/113182#M23683 <P>Hi,</P> <P>When the maxVolumeDataSizeMB for the primary volume is exceeded, will the events automatically roll over to the secondary volume? </P> <P>Here are my settings:</P> <P>[volume:primary]<BR /> path = /apps/splunk/db</P> <H1>500GB</H1> <P>maxVolumeDataSizeMB = 500000<BR /> [volume:secondary]<BR /> path = /apps/splunk/colddb</P> <H1># 5,000GB</H1> <P>maxVolumeDataSizeMB = 5000000</P> Wed, 05 Nov 2014 18:22:01 GMT https://community.splunk.com/t5/Getting-Data-In/When-the-maxVolumeDataSizeMB-for-the-primary-volume-is-exceeded/m-p/113182#M23683 a212830 2014-11-05T18:22:01Z https://community.splunk.com/t5/Getting-Data-In/When-the-maxVolumeDataSizeMB-for-the-primary-volume-is-exceeded/m-p/113183#M23684 <P>If the maxVolumeDataSizeMB reaches the hot/warm bucket with the least latest value of latest-time is moved to colddb, the same applies to cold buckets if it happens to the volume:secondary, until the volume is below the maximum size.<BR /> - A warm bucket will be pushed to cold (chilled)<BR /> - A cold bucket will be pushed to frozen</P> <P>As of this writing this trim operation, scheduling bucket movement will stop working if the minFreeSpace, 5GB by default is once hit, which will make the situation worse. - This will be enhanced in 6.3.</P> <P>Also make sure to take this into account, by default, report acceleration summaries can theoretically take up an unlimited amount of disk space. This can be a problem if you're also locking down the maximum data size of your indexes or index volumes. Find the details from the link below;<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Manageacceleratedsearchsummaries#Configure_size-based_retention_for_report_acceleration_summaries">http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Manageacceleratedsearchsummaries#Configure_size-based_retention_for_report_acceleration_summaries</A></P> Tue, 09 Jun 2015 01:50:34 GMT https://community.splunk.com/t5/Getting-Data-In/When-the-maxVolumeDataSizeMB-for-the-primary-volume-is-exceeded/m-p/113183#M23684 sylim_splunk 2015-06-09T01:50:34Z https://community.splunk.com/t5/Getting-Data-In/When-the-maxVolumeDataSizeMB-for-the-primary-volume-is-exceeded/m-p/113184#M23685 <P>Is there any place in the official Splunk documentation where this answer is spelled out? </P> Wed, 07 Jun 2017 17:20:16 GMT https://community.splunk.com/t5/Getting-Data-In/When-the-maxVolumeDataSizeMB-for-the-primary-volume-is-exceeded/m-p/113184#M23685 IamaRobot 2017-06-07T17:20:16Z https://community.splunk.com/t5/Getting-Data-In/When-the-maxVolumeDataSizeMB-for-the-primary-volume-is-exceeded/m-p/113185#M23686 <P>I believe <A href="http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstorage">Configure index storage</A> and a <A href="https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy">Set a Retirement and Archiving Policy</A> covers this...</P> Thu, 08 Jun 2017 04:19:38 GMT https://community.splunk.com/t5/Getting-Data-In/When-the-maxVolumeDataSizeMB-for-the-primary-volume-is-exceeded/m-p/113185#M23686 gjanders 2017-06-08T04:19:38Z