What is the expected behavior of setting maxTotalDataSizeMB=0

[the_wolverine]

The documentation infers:

http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Indexesconf

maxTotalDataSizeMB =

• The maximum size of an index (in MB).
• If an index grows larger than the maximum size, the oldest data is frozen.
• This paremeter only applies to hot, warm, and cold buckets. It does not apply to thawed buckets.
• Defaults to 500000.
• Highest legal value is 4294967295

[yannK · Accepted solution]

The expected behavior for maxTotalDataSizeMB=0 is to use an unlimited size for the index.
However there is a known bug for splunk 4.3.1 to 4.3.2 fixed in 4.3.3 that considered the
"0" value as a "zero" and shrinked the index.

see : http://docs.splunk.com/Documentation/Splunk/4.3.1/ReleaseNotes/Knownissues
and http://docs.splunk.com/Documentation/Splunk/4.3.3/ReleaseNotes/4.3.3

Setting maxTotalDataSizeMB = 0 causes the index to be deleted on restart (rather than allowing infinite index size, which is what one would expect). (SPL-49535)

[the_wolverine]

RUT ROH...