volumes can hot/warm and cold be combined with one stanza?

[dhaffner]

Are the hot/warm buckets required to be on a separate volume from the cold?
Or, can I set just one volume and have hot, warm and cold all going there?

Example:
[volume:data]

path = /data/splunk

maxVolumeDataSizeMB = 40960

[_audit]

homePath = volume:data/audit/db

coldPath = volume:data/audit/colddb

thawedPath = /data/splunk/audit/thaweddb

Thanks

[sowings]

Yes. The same disk limit will apply to all indexes, and all paths, hot/warm and cold.

Note that when size-based restrictions are applied, the oldest bucket in the index is culled. When using volume-based size restrictions, the oldest bucket in any index is frozen, so it might make sense to also apply time-based rules to keep your fast-growing sources in line.