https://community.splunk.com/t5/Getting-Data-In/Can-you-set-a-maximum-hot-index-size-globally/m-p/59870#M96876 <P>You can make use of volume notation in indexes.conf for hot and warm. Note that hot and warm should be on the same path. As usual, there is more info here: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf</A> </P> <P>indexes.conf</P> <HR /> <P><CODE>[volume:hot1]<BR /> path = /mnt/fast_disk<BR /> maxVolumeDataSizeMB = 100000</CODE></P> <P><CODE>[volume:cold1]<BR /> path = /mnt/big_disk</CODE></P> <P><CODE>[idx1]<BR /> homePath = volume:hot1/idx1<BR /> coldPath = volume:cold1/idx1</CODE></P> <P><CODE>[idx2]<BR /> homePath = volume:hot1/idx2<BR /> coldPath = volume:cold1/idx2</CODE></P> <HR /> <P>Hope it helps</P> <P><CODE>please upvote if you find this answer useful</CODE></P> Fri, 25 May 2012 00:14:01 GMT _d_ 2012-05-25T00:14:01Z https://community.splunk.com/t5/Getting-Data-In/Can-you-set-a-maximum-hot-index-size-globally/m-p/59869#M96875 <P>We would like to use a combination of solid state drives for the hot index and slower, cheaper disk for the warm/cold buckets. Is there a way to tell Splunk that the total size of all hot indexes should not exceed a certain size and roll events when that size is reached? </P> <P>Thanks.</P> <P>Craig</P> Thu, 24 May 2012 22:18:16 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-set-a-maximum-hot-index-size-globally/m-p/59869#M96875 responsys_cm 2012-05-24T22:18:16Z https://community.splunk.com/t5/Getting-Data-In/Can-you-set-a-maximum-hot-index-size-globally/m-p/59870#M96876 <P>You can make use of volume notation in indexes.conf for hot and warm. Note that hot and warm should be on the same path. As usual, there is more info here: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf</A> </P> <P>indexes.conf</P> <HR /> <P><CODE>[volume:hot1]<BR /> path = /mnt/fast_disk<BR /> maxVolumeDataSizeMB = 100000</CODE></P> <P><CODE>[volume:cold1]<BR /> path = /mnt/big_disk</CODE></P> <P><CODE>[idx1]<BR /> homePath = volume:hot1/idx1<BR /> coldPath = volume:cold1/idx1</CODE></P> <P><CODE>[idx2]<BR /> homePath = volume:hot1/idx2<BR /> coldPath = volume:cold1/idx2</CODE></P> <HR /> <P>Hope it helps</P> <P><CODE>please upvote if you find this answer useful</CODE></P> Fri, 25 May 2012 00:14:01 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-set-a-maximum-hot-index-size-globally/m-p/59870#M96876 _d_ 2012-05-25T00:14:01Z