Deployment Architecture

volumes can hot/warm and cold be combined with one stanza?

Path Finder

Are the hot/warm buckets required to be on a separate volume from the cold?
Or, can I set just one volume and have hot, warm and cold all going there?


path = /data/splunk

maxVolumeDataSizeMB = 40960


homePath = volume:data/audit/db

coldPath = volume:data/audit/colddb

thawedPath = /data/splunk/audit/thaweddb


0 Karma

Splunk Employee
Splunk Employee

Yes. The same disk limit will apply to all indexes, and all paths, hot/warm and cold.

Note that when size-based restrictions are applied, the oldest bucket in the index is culled. When using volume-based size restrictions, the oldest bucket in any index is frozen, so it might make sense to also apply time-based rules to keep your fast-growing sources in line.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!