I'm planning to use the deployment server to deploy configs to my indexers and use network storage for the cold DB. I have the following in indexes.conf:
[foo] homePath = $SPLUNK_DB/foo/db coldPath = /nfs/foo-splunk/storage/foo/colddb thawedPath = $SPLUNK_DB/foo/thaweddb maxDataSize = auto_high_volume maxWarmDBCount = 7 maxTotalDataSizeMB = 220000 frozenTimePeriodInSecs = 1900800
When I have multiple indexes how is this applied? For example is the maxTotalDataSizeMB per indexer or per index?
Can multiple indexers use the same location for the colddb?
To clarify, let's say I have two indexers. On each of these indexers, I set the size of foo in indexes.conf as
Each indexer must write to its own directory (typically on local disk for performance reasons). The max size of the index is the SUM of all of the space allocated by all indexers = 200000 MB
The above stanza will be applied to the foo index only. no matter how many other indexes you have.
maxTotalDataSizeMB will be per index, ie only for the foo index. (if you are deploying this to more then one indexer, this will be so for all those indexers, but again, only for the foo index.)
You can NOT use the same location for multiple indexers (otherwise you would have clashes between the data). If you want to use the same nfs then you should probably create directories for all your indexers say:
/nfs/indexer1/foo/ /nfs/indexer2/foo/ etc..
Thanks Genti. I understand that this config only applies to the foo index I'm trying to clarify what happens when this index is distributed across multiple indexers. You say that maxTotalDataSizeMB would apply to all indexers. Does that mean it has the same limit on each indexer or that the limit is across all indexers?
Is the hostname available as a variable in indexes.conf so I can do /nfs/$HOSTNAME/foo/ and deploy the same config to all indexers?