Getting Data In

How can I roll data from one location to another based on volume max size?

daniel333
Builder

All,

I have the following config in my indexes.conf

### define volumes
[volume:splunklocal]
path = /splunk_data
maxVolumeDataSizeMB = 600000

...

[akamai]
repFactor=auto
homePath   = volume:splunklocal/akamai/db
coldPath   = volume:splunklocal/akamai/colddb
thawedPath = $SPLUNK_DB/akamai/thaweddb
frozenTimePeriodInSecs = 7776000

The volume splunklocal is 600gigs. When this maxes out I was hoping to roll older logs to another volume called splunkbrozestorage. Is this possible? That is to say, I am not hitting my 90 days policy. I am hitting the volume size limitation. So I installed another volume of disks to roll to.

Any ideas? Docs?

0 Karma

tmarlette
Motivator

Do both volumes need to be the same bucket type? say both volumes are hot (homePath) or both volumes are cold (coldPath)

0 Karma

daniel333
Builder

A little bucket stupid here, I've largely left these the defaults. But if I am understanding you correctly you're asking if I want to move cold or warm. For the most part I am thinking I Just need to move the cold storage while leaving the warm where it is. I just don't know how to control the the point where we max the warm buckets out in this case?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...