Deployment Architecture

What does "remove" mean in reference to maxVolumeDataSizeMB?


Working on tuning indexers, volumes and storage. We are seeing indexers fill over what we anticipated so I wanted to reduce maxVolumeDataSizeMB. The docs wording on this isnt necessarily clear, what does "If the size is exceeded, Splunk will remove buckets with the oldest value of latest time (for a given bucket)
across all indexes in the volume, until the volume is below the maximum size. " mean in reference to maxVolumeDataSizeMB?


Does it delete(freeze) the data or does it roll it to cold?

Labels (3)
0 Karma

If you submit Feedback on that docs page then the Docs team very likely will make the page clearer.
I believe (with no evidence to back this up) that buckets will roll to cold. If size is still exceeded then buckets will be frozen.
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...