All,
I have the following config in my indexes.conf
### define volumes
[volume:splunklocal]
path = /splunk_data
maxVolumeDataSizeMB = 600000
...
[akamai]
repFactor=auto
homePath = volume:splunklocal/akamai/db
coldPath = volume:splunklocal/akamai/colddb
thawedPath = $SPLUNK_DB/akamai/thaweddb
frozenTimePeriodInSecs = 7776000
The volume splunklocal is 600gigs. When this maxes out I was hoping to roll older logs to another volume called splunkbrozestorage. Is this possible? That is to say, I am not hitting my 90 days policy. I am hitting the volume size limitation. So I installed another volume of disks to roll to.
Any ideas? Docs?
Do both volumes need to be the same bucket type? say both volumes are hot (homePath) or both volumes are cold (coldPath)
A little bucket stupid here, I've largely left these the defaults. But if I am understanding you correctly you're asking if I want to move cold or warm. For the most part I am thinking I Just need to move the cold storage while leaving the warm where it is. I just don't know how to control the the point where we max the warm buckets out in this case?