Getting Data In

How can I roll data from one location to another based on volume max size?

daniel333
Builder

All,

I have the following config in my indexes.conf

### define volumes
[volume:splunklocal]
path = /splunk_data
maxVolumeDataSizeMB = 600000

...

[akamai]
repFactor=auto
homePath   = volume:splunklocal/akamai/db
coldPath   = volume:splunklocal/akamai/colddb
thawedPath = $SPLUNK_DB/akamai/thaweddb
frozenTimePeriodInSecs = 7776000

The volume splunklocal is 600gigs. When this maxes out I was hoping to roll older logs to another volume called splunkbrozestorage. Is this possible? That is to say, I am not hitting my 90 days policy. I am hitting the volume size limitation. So I installed another volume of disks to roll to.

Any ideas? Docs?

0 Karma

tmarlette
Motivator

Do both volumes need to be the same bucket type? say both volumes are hot (homePath) or both volumes are cold (coldPath)

0 Karma

daniel333
Builder

A little bucket stupid here, I've largely left these the defaults. But if I am understanding you correctly you're asking if I want to move cold or warm. For the most part I am thinking I Just need to move the cold storage while leaving the warm where it is. I just don't know how to control the the point where we max the warm buckets out in this case?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...