topic Re: Splunk summery volume in Monitoring Splunk

Splunk summery volume

m_zandinia — Wed, 29 Sep 2021 08:22:05 GMT

Hi Splunkers! I hope you all are doing well.

This is my indexes.conf

My problem is that the COLD volume was fulled.

This is the output of df command

The fs of COLD volume is xfs

Do you know that the total maxsize of both COLD and splunk_summareis must not exceed from total space or Just setting the COLD volume is enough because the splunk_summaries volume is part of that?

I mean in my case Splunk set the addition of both volume:COLD and volume:_splunk_summaries for total space for storing buckets or just set the maxVolumesize of volume:COLD config?

Thanks in advance for any advice

PS: I know Splunk do recommend that the summaries must be stored in HOT volume!

Re: Splunk summery volume

PickleRick — Wed, 29 Sep 2021 09:20:42 GMT

Let's see in the docs:

maxVolumeDataSizeMB = <positive integer> * If set, this setting limits the total size of all databases that reside on this volume to the maximum size specified, in MB. Note that this it will act only on those indexes which reference this volume, not on the total size of the path set in the 'path' setting of this volume.

In other words, the limit for your COLD volume limits only cumulative size of databases directly referencing this volume. The _splunk_summaries volume has its own independent limit. So effectively you may grow your /Splunk-Storage/COLD directory up to 4674000MB (probably a bit more, considering some metadata overhead and so on)