Hi, we have three clustered indexers and are looking to leverage slow disks for the cold paths. I'm wondering if it is acceptable to only have a volume configuration for this. Or must the home paths also be defined as a volume (Yes a noob). I'm considering something like this in the indexes.conf:
[volume:cold]
path = /path/to/slower/disk
# 5TB with some headroom leftover (data summaries, etc)
maxVolumeDataSizeMB = 4600000
And then reference the path to the cold volume:
[adf]
thawedPath = $SPLUNK_DB/adf/thaweddb
homePath = $SPLUNK_DB/adf/db
coldPath = $SPLUNK_DB/adf/colddb
coldPath = volume:cold/adf/colddb
Hey,
that's perfectly fine, if you remove the second last line, like this:
[volume:cold]
path = /path/to/slower/disk
# 5TB with some headroom leftover (data summaries, etc)
maxVolumeDataSizeMB = 4600000
[adf]
thawedPath = $SPLUNK_DB/adf/thaweddb
homePath = $SPLUNK_DB/adf/db
coldPath = volume:cold/adf/colddb
You're not required to either go all volumes or no volumes at all - you can mix it. 🙂
Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂
Hey,
that's perfectly fine, if you remove the second last line, like this:
[volume:cold]
path = /path/to/slower/disk
# 5TB with some headroom leftover (data summaries, etc)
maxVolumeDataSizeMB = 4600000
[adf]
thawedPath = $SPLUNK_DB/adf/thaweddb
homePath = $SPLUNK_DB/adf/db
coldPath = volume:cold/adf/colddb
You're not required to either go all volumes or no volumes at all - you can mix it. 🙂
Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂
thank you!