Deployment Architecture

What does "remove" mean in reference to maxVolumeDataSizeMB?

tkw03
Communicator

Working on tuning indexers, volumes and storage. We are seeing indexers fill over what we anticipated so I wanted to reduce maxVolumeDataSizeMB. The docs wording on this isnt necessarily clear, what does "If the size is exceeded, Splunk will remove buckets with the oldest value of latest time (for a given bucket)
across all indexes in the volume, until the volume is below the maximum size. " mean in reference to maxVolumeDataSizeMB?

 

Does it delete(freeze) the data or does it roll it to cold?

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
If you submit Feedback on that docs page then the Docs team very likely will make the page clearer.
I believe (with no evidence to back this up) that buckets will roll to cold. If size is still exceeded then buckets will be frozen.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...