Working on tuning indexers, volumes and storage. We are seeing indexers fill over what we anticipated so I wanted to reduce maxVolumeDataSizeMB. The docs wording on this isnt necessarily clear, what does "If the size is exceeded, Splunk will remove buckets with the oldest value of latest time (for a given bucket) across all indexes in the volume, until the volume is below the maximum size. " mean in reference to maxVolumeDataSizeMB?
Does it delete(freeze) the data or does it roll it to cold?
If you submit Feedback on that docs page then the Docs team very likely will make the page clearer. I believe (with no evidence to back this up) that buckets will roll to cold. If size is still exceeded then buckets will be frozen.
--- If this reply helps you, Karma would be appreciated.