Getting Data In

This volume configuration will *not* manage space used by this index

yannK
Splunk Employee
Splunk Employee

I have indexes configured with volumes and started to see this warning after upgrade to 6.*

10-16-2013 18:18:20.951 -0700 ERROR IndexConfig - idx=idx1 Path coldPath='/opt/splunk/var/lib/splunk/idx2/cold' (realpath '/opt/splunk/var/lib/splunk/idx1/cold') is inside volume=hot1 (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by coldPath will *not* be volume-mananged.  Config error?`

Myindexes.conf:

[volume:hot1]
path = /opt/splunk/var/lib/splunk/
maxVolumeDataSizeMB = 100000

[idx1]
homePath = volume:hot1/idx1hot
coldPath = $SPLUNK_DB/idx1cold
thawedPath=$SPLUNK_DB/idx1thawed
1 Solution

sowings
Splunk Employee
Splunk Employee

This warning would have appeared in 5 as well. It looks like your volume:hot1 path is the self-same as the default value of $SPLUNK_DB. By declaring this path the root of your volume, Splunk expects that all of the other indexes that are children of this path should be part of the volume as well.

Now take, for example, the coldPath you've provided: Since the coldPath is also a child of /opt/splunk/var/lib/splunk, but does not include a volume:hot1 tag in its definition, Splunk generate the warning you see. This means that the cold space for that index won't be subject to maxVolumeDataSizeMB.

View solution in original post

sowings
Splunk Employee
Splunk Employee

This warning would have appeared in 5 as well. It looks like your volume:hot1 path is the self-same as the default value of $SPLUNK_DB. By declaring this path the root of your volume, Splunk expects that all of the other indexes that are children of this path should be part of the volume as well.

Now take, for example, the coldPath you've provided: Since the coldPath is also a child of /opt/splunk/var/lib/splunk, but does not include a volume:hot1 tag in its definition, Splunk generate the warning you see. This means that the cold space for that index won't be subject to maxVolumeDataSizeMB.

sowings
Splunk Employee
Splunk Employee

And I'll note here that thawed is a) exempt from retention rules, volume based or no, and b) it cannot use a volume definition (perhaps because of a).

0 Karma

yannK
Splunk Employee
Splunk Employee

The issue was that $SPLUNK_DB and volume:hot1 were pointing to the same exact folder, therefore the size limits were not considering all the subfolders of this location using the same approach.

I fixed the warming message by using the volume for my hot/cold, and any othr indexed that were using $SPLUNK_DB

`[volume:hot1]
path = /opt/splunk/var/lib/splunk/
maxVolumeDataSizeMB = 100000

[idx1]
homePath = volume:hot1/idx1hot
coldPath = volume:hot1/idx1cold
thawedPath=$SPLUNK_DB/idx1thawed
`

0 Karma

mkelderm
Path Finder

Thanks for the answer! You are right about $SPLUNK_DB. I will change that. But meanwhile, this "ERROR" is really not an error?

0 Karma

sowings
Splunk Employee
Splunk Employee

In my opinion, it's more of a warning. If your goal was to treat the location at /opt/splunk/var/lib/splunk as a "volume" (I tend to think of this as "partition", from my Unix-y background), then it's an alert that Splunk is not going to "Do What I Mean". It could manifest as an issue where data is archived sooner than expected or the disk partition is allowed to fill because some index paths were not part of the volume restriction.

0 Karma

mkelderm
Path Finder

Hi, same here since 6.0

10-25-2013 12:52:40.537 +0200 ERROR ProcessTracker - (child_27__Fsck) IndexConfig - idx=_audit Path coldPath='/data/splunkdb/audit/colddb' (realpath '/data/splunkdb/audit/colddb') is inside volume=splunkdb_warm (path='/data/splunkdb', realpath='/data/splunkdb'), but does not reference that volume. Space used by coldPath will not be volume-mananged. Config error?

Did you find a solution?

Marc

0 Karma

yannK
Splunk Employee
Splunk Employee

The issue was that $SPLUNK_DB and volume:hot1 were pointing to the same exact folder, therefore the size limits were not considering all the subfolders of this location using the same approach.
I fixed the warming message by using the volume for my hot/cold, and any othr indexed that were using $SPLUNK_DB

This is not an error, just a warning.

0 Karma

anupjishnu
Path Finder

I see this listed as error in 6.2 splunkd.log

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...