<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic When using volumes, does Splunk count only index files or others too? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/When-using-volumes-does-Splunk-count-only-index-files-or-others/m-p/26393#M4344</link>
    <description>&lt;P&gt;Question regarding 4.2+'s abililty to put a maxVolumeDataSizeMB on an arbitrary path, call it a volume, and put indexes in it.&lt;/P&gt;

&lt;P&gt;I have some indexes at &lt;CODE&gt;/data/indexes&lt;/CODE&gt; and also my syslog server logs to &lt;CODE&gt;/data/logs&lt;/CODE&gt;.&lt;/P&gt;

&lt;P&gt;If I set my index volume to be &lt;CODE&gt;/data&lt;/CODE&gt;, will Splunk include the syslog logs in the volume size so I will never overrun my disk space? (If syslog data explodes for a few days, I would rather have old index buckets deleted than run against a disk space limit and stop accepting new data!)&lt;/P&gt;</description>
    <pubDate>Fri, 10 Jun 2011 13:54:36 GMT</pubDate>
    <dc:creator>Jason</dc:creator>
    <dc:date>2011-06-10T13:54:36Z</dc:date>
    <item>
      <title>When using volumes, does Splunk count only index files or others too?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/When-using-volumes-does-Splunk-count-only-index-files-or-others/m-p/26393#M4344</link>
      <description>&lt;P&gt;Question regarding 4.2+'s abililty to put a maxVolumeDataSizeMB on an arbitrary path, call it a volume, and put indexes in it.&lt;/P&gt;

&lt;P&gt;I have some indexes at &lt;CODE&gt;/data/indexes&lt;/CODE&gt; and also my syslog server logs to &lt;CODE&gt;/data/logs&lt;/CODE&gt;.&lt;/P&gt;

&lt;P&gt;If I set my index volume to be &lt;CODE&gt;/data&lt;/CODE&gt;, will Splunk include the syslog logs in the volume size so I will never overrun my disk space? (If syslog data explodes for a few days, I would rather have old index buckets deleted than run against a disk space limit and stop accepting new data!)&lt;/P&gt;</description>
      <pubDate>Fri, 10 Jun 2011 13:54:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/When-using-volumes-does-Splunk-count-only-index-files-or-others/m-p/26393#M4344</guid>
      <dc:creator>Jason</dc:creator>
      <dc:date>2011-06-10T13:54:36Z</dc:date>
    </item>
    <item>
      <title>Re: When using volumes, does Splunk count only index files or others too?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/When-using-volumes-does-Splunk-count-only-index-files-or-others/m-p/26394#M4345</link>
      <description>&lt;P&gt;According to &lt;A href="http://splunk-base.splunk.com/users/15/gkanapathy"&gt;gkanapathy&lt;/A&gt;, ONLY splunk indexes are counted, not other files that may be in the volume.&lt;/P&gt;</description>
      <pubDate>Fri, 10 Jun 2011 17:47:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/When-using-volumes-does-Splunk-count-only-index-files-or-others/m-p/26394#M4345</guid>
      <dc:creator>Jason</dc:creator>
      <dc:date>2011-06-10T17:47:43Z</dc:date>
    </item>
  </channel>
</rss>

