Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Max bucket size is larger than destination path si...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Max bucket size is larger than destination path size limit
hello
i have index with this conf:
[ssys_emea_pj] homePath = volume:hotwarm/$_index_name/db
coldPath =
volume:cold/$_index_name/colddb
thawedPath =
$SPLUNK_DB/$_index_name/thaweddb
coldToFrozenDir =
/splunkData/frozen/$_index_name(c) igor@emet 2019-02-18
Don't forget to update those values when you resize the volume
homePath.maxDataSizeMB = 40000
coldPath.maxDataSizeMB = 10000
frozenTimePeriodInSecs = 31104000
maxDataSize = auto_high_volume
from btool :
maxTotalDataSizeMB = 500000
im getting this error:
Max bucket size is larger than destination path size limit
i don't know if this is the reason but not all my data have being indexed from s3 bucket
from the same folder, not all the sub folders are indexed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Max Bucket size error you are getting because you have configured maxDataSize = auto_high_volume, on 64-bit OS auto_high_volume = 10GB and you have coldPath.maxDataSizeMB = 10000 which is less than 10GB (10240MB)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so what should be the right value ?
does the fact that not all the data indexed from s3 ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know how you are ingesting data and I didn't understand question regarding S3.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My data source is s3 bucket
I have a problem that not all the data there are indexed. From the same folder some of the sub folders not indexed
So i wondered if this error is the reason
By the way, my system is linux. the values you mentioned are the same ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'll suggest to lower maxDataSize in indexes.conf for index ssys_emea_pj
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It was 10000 when i saw this error
Index This | Why did the turkey cross the road?
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Feel the Splunk Love: Real Stories from Real Customers
