Getting Data In

When the maxVolumeDataSizeMB for the primary volume is exceeded, will events automatically roll over to the secondary volume?

a212830
Champion

Hi,

When the maxVolumeDataSizeMB for the primary volume is exceeded, will the events automatically roll over to the secondary volume?

Here are my settings:

[volume:primary]
path = /apps/splunk/db

500GB

maxVolumeDataSizeMB = 500000
[volume:secondary]
path = /apps/splunk/colddb

# 5,000GB

maxVolumeDataSizeMB = 5000000

sylim_splunk
Splunk Employee
Splunk Employee

If the maxVolumeDataSizeMB reaches the hot/warm bucket with the least latest value of latest-time is moved to colddb, the same applies to cold buckets if it happens to the volume:secondary, until the volume is below the maximum size.
- A warm bucket will be pushed to cold (chilled)
- A cold bucket will be pushed to frozen

As of this writing this trim operation, scheduling bucket movement will stop working if the minFreeSpace, 5GB by default is once hit, which will make the situation worse. - This will be enhanced in 6.3.

Also make sure to take this into account, by default, report acceleration summaries can theoretically take up an unlimited amount of disk space. This can be a problem if you're also locking down the maximum data size of your indexes or index volumes. Find the details from the link below;
http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Manageacceleratedsearchsummaries#Configu...

IamaRobot
New Member

Is there any place in the official Splunk documentation where this answer is spelled out?

0 Karma

gjanders
SplunkTrust
SplunkTrust

I believe Configure index storage and a Set a Retirement and Archiving Policy covers this...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.