Working on tuning indexers, volumes and storage. We are seeing indexers fill over what we anticipated so I wanted to reduce maxVolumeDataSizeMB. The docs wording on this isnt necessarily clear, what does "If the size is exceeded, Splunk will remove buckets with the oldest value of latest time (for a given bucket)
across all indexes in the volume, until the volume is below the maximum size. " mean in reference to maxVolumeDataSizeMB?
Does it delete(freeze) the data or does it roll it to cold?