Getting Data In

This volume configuration will *not* manage space used by this index

Splunk Employee
Splunk Employee

I have indexes configured with volumes and started to see this warning after upgrade to 6.*

10-16-2013 18:18:20.951 -0700 ERROR IndexConfig - idx=idx1 Path coldPath='/opt/splunk/var/lib/splunk/idx2/cold' (realpath '/opt/splunk/var/lib/splunk/idx1/cold') is inside volume=hot1 (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by coldPath will *not* be volume-mananged.  Config error?`

Myindexes.conf:

[volume:hot1]
path = /opt/splunk/var/lib/splunk/
maxVolumeDataSizeMB = 100000

[idx1]
homePath = volume:hot1/idx1hot
coldPath = $SPLUNK_DB/idx1cold
thawedPath=$SPLUNK_DB/idx1thawed
1 Solution

Splunk Employee
Splunk Employee

This warning would have appeared in 5 as well. It looks like your volume:hot1 path is the self-same as the default value of $SPLUNK_DB. By declaring this path the root of your volume, Splunk expects that all of the other indexes that are children of this path should be part of the volume as well.

Now take, for example, the coldPath you've provided: Since the coldPath is also a child of /opt/splunk/var/lib/splunk, but does not include a volume:hot1 tag in its definition, Splunk generate the warning you see. This means that the cold space for that index won't be subject to maxVolumeDataSizeMB.

View solution in original post

Splunk Employee
Splunk Employee

This warning would have appeared in 5 as well. It looks like your volume:hot1 path is the self-same as the default value of $SPLUNK_DB. By declaring this path the root of your volume, Splunk expects that all of the other indexes that are children of this path should be part of the volume as well.

Now take, for example, the coldPath you've provided: Since the coldPath is also a child of /opt/splunk/var/lib/splunk, but does not include a volume:hot1 tag in its definition, Splunk generate the warning you see. This means that the cold space for that index won't be subject to maxVolumeDataSizeMB.

View solution in original post

Splunk Employee
Splunk Employee

And I'll note here that thawed is a) exempt from retention rules, volume based or no, and b) it cannot use a volume definition (perhaps because of a).

0 Karma

Splunk Employee
Splunk Employee

The issue was that $SPLUNK_DB and volume:hot1 were pointing to the same exact folder, therefore the size limits were not considering all the subfolders of this location using the same approach.

I fixed the warming message by using the volume for my hot/cold, and any othr indexed that were using $SPLUNK_DB

`[volume:hot1]
path = /opt/splunk/var/lib/splunk/
maxVolumeDataSizeMB = 100000

[idx1]
homePath = volume:hot1/idx1hot
coldPath = volume:hot1/idx1cold
thawedPath=$SPLUNK_DB/idx1thawed
`

0 Karma

Path Finder

Thanks for the answer! You are right about $SPLUNK_DB. I will change that. But meanwhile, this "ERROR" is really not an error?

0 Karma

Splunk Employee
Splunk Employee

In my opinion, it's more of a warning. If your goal was to treat the location at /opt/splunk/var/lib/splunk as a "volume" (I tend to think of this as "partition", from my Unix-y background), then it's an alert that Splunk is not going to "Do What I Mean". It could manifest as an issue where data is archived sooner than expected or the disk partition is allowed to fill because some index paths were not part of the volume restriction.

0 Karma

Path Finder

Hi, same here since 6.0

10-25-2013 12:52:40.537 +0200 ERROR ProcessTracker - (child_27__Fsck) IndexConfig - idx=_audit Path coldPath='/data/splunkdb/audit/colddb' (realpath '/data/splunkdb/audit/colddb') is inside volume=splunkdb_warm (path='/data/splunkdb', realpath='/data/splunkdb'), but does not reference that volume. Space used by coldPath will not be volume-mananged. Config error?

Did you find a solution?

Marc

0 Karma

Splunk Employee
Splunk Employee

The issue was that $SPLUNK_DB and volume:hot1 were pointing to the same exact folder, therefore the size limits were not considering all the subfolders of this location using the same approach.
I fixed the warming message by using the volume for my hot/cold, and any othr indexed that were using $SPLUNK_DB

This is not an error, just a warning.

0 Karma

Path Finder

I see this listed as error in 6.2 splunkd.log

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!