Splunk Search

Splunk volume exceeding maxVolumeDataSizeMb setting

rsantoso_splunk
Splunk Employee
Splunk Employee

The /volumes/summaries directory is the location of data model acceleration summaries:
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf [volume:_splunk_summaries]
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf path = /volumes/summaries/
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf maxVolumeDataSizeMB = 95000

The volume on /volumes/summaries:
$ df -m
Filesystem 1M-blocks Used Available Use% Mounted on
/dev/sde 100664 100534 115 100% /volumes/summaries

As seen above, the volume should not exceed 95GB as per configured however it hitting the available volume 100G.

Error Messages:
ERROR SummarySizeManager - Cannot compute the summary size on path="/volumes/summaries//datamodel_summary/": No such file or directory

Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

Resolution is to reduce the size of maxVolumeDataSizeMB to lower value 90GB.

  1. maxVolumeDataSizeMB is not to be exactly the same measure of df/file system
  2. The Reason is that when calculating the size of bucket, splunk only add up the file size under the buckets. Directory is not counted. Suppose customer has a big number of buckets/directory, the margin between splunk and df measurement can be big. A normal directory size is 4K, if they have one million directory under the bucket directory, there would be 4GB gap.

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

Resolution is to reduce the size of maxVolumeDataSizeMB to lower value 90GB.

  1. maxVolumeDataSizeMB is not to be exactly the same measure of df/file system
  2. The Reason is that when calculating the size of bucket, splunk only add up the file size under the buckets. Directory is not counted. Suppose customer has a big number of buckets/directory, the margin between splunk and df measurement can be big. A normal directory size is 4K, if they have one million directory under the bucket directory, there would be 4GB gap.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...