We are using volume partitions for the indexes.conf and the hot volume is getting full around 90% on the disk.
[volume:hotwarm] path = /mnt/hot [volume:cold] path = /mnt/cold [xxxxxx] homePath = volume:hotwarm/xxxxxxxx/db coldPath = volume:cold/xxxxxxx/colddb thawedPath = $SPLUNK_DB/xxxxxxx/thaweddb homePath.maxDataSizeMB = 2000000 coldPath.maxDataSizeMB = 15664000 frozenTimePeriodInSecs = 2160000 maxTotalDataSizeMB = 34664000 maxDataSize = auto_high_volume repFactor = auto
This is the indexes.conf being used. Please suggest a method to reduce the hot volume size
In general, how to reduce the hot volume for an index.
*You can configure a maximum size for your hotwarm volume to ensure it never grows beyond that size. See this:
Basically in your homePath or hotwarm volume contains your hot buckets (default count 4) and warm buckets (default count 300)*. With your maxDataSize =autohighvolume, each bucket (hot or warm) will be sufficiently large, hence your volume is full. So you can define max size for your homepath or hotwarm volumen (per above link) OR adjust your warm bucket count/sizes.
Will there be any chance that your daily data might grow with time? If it does, you might want to keep a check on warm bucket counts as it may need adjustments with growing data.
The index volume might be the same or increase a little bit , we might add new indexes which might increase the overall volume.
Suppose we put a limit of warm buckets to an index and it has increased the indexing volume, what would be the consequences and is it needed to increase or change the warm bucket count if there is increase or decrease the indexing volume for that index ?