topic Re: Why are indexes with hot/warm and cold paths on volumes showing as empty in dbinspect? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-are-indexes-with-hot-warm-and-cold-paths-on-volumes-showing/m-p/388542#M69573 <P>So I might have answered this question with the help of Splunk support. We'll know after our maintenance window this afternoon.</P> <P>In short, when we defined our volumes, we chose a path on the file system which contains a protected keyword which is present in code. In our case, we chose <EM>/splunkdb-hot</EM>. And as it turns out, <EM>db-hot</EM> used to be part of the name of hot buckets in older versions of Splunk.</P> <P>Will update again soon.</P> Fri, 05 Apr 2019 16:01:34 GMT brettwilliams 2019-04-05T16:01:34Z Why are indexes with hot/warm and cold paths on volumes showing as empty in dbinspect? https://community.splunk.com/t5/Getting-Data-In/Why-are-indexes-with-hot-warm-and-cold-paths-on-volumes-showing/m-p/388541#M69572 <P>This seems weird. My index clusters (dev, qa, and production environments) seem to be completely ignoring my indexes configuration.</P> <P>The sizeOnDiskMB value for indexes in /opt/splunk shows values as expected. And when I tweaked my indexes.conf, the cluster dutifully froze buckets. But for indexes with hot/warm and cold volumes, sizeOnDeskMB is ZERO. Weird.</P> <P>I'm on 7.0.7.</P> Tue, 02 Apr 2019 21:47:17 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-indexes-with-hot-warm-and-cold-paths-on-volumes-showing/m-p/388541#M69572 brettwilliams 2019-04-02T21:47:17Z Re: Why are indexes with hot/warm and cold paths on volumes showing as empty in dbinspect? https://community.splunk.com/t5/Getting-Data-In/Why-are-indexes-with-hot-warm-and-cold-paths-on-volumes-showing/m-p/388542#M69573 <P>So I might have answered this question with the help of Splunk support. We'll know after our maintenance window this afternoon.</P> <P>In short, when we defined our volumes, we chose a path on the file system which contains a protected keyword which is present in code. In our case, we chose <EM>/splunkdb-hot</EM>. And as it turns out, <EM>db-hot</EM> used to be part of the name of hot buckets in older versions of Splunk.</P> <P>Will update again soon.</P> Fri, 05 Apr 2019 16:01:34 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-indexes-with-hot-warm-and-cold-paths-on-volumes-showing/m-p/388542#M69573 brettwilliams 2019-04-05T16:01:34Z