Getting Data In

When the maxVolumeDataSizeMB for the primary volume is exceeded, will events automatically roll over to the secondary volume?

a212830
Champion

Hi,

When the maxVolumeDataSizeMB for the primary volume is exceeded, will the events automatically roll over to the secondary volume?

Here are my settings:

[volume:primary]
path = /apps/splunk/db

500GB

maxVolumeDataSizeMB = 500000
[volume:secondary]
path = /apps/splunk/colddb

# 5,000GB

maxVolumeDataSizeMB = 5000000

sylim_splunk
Splunk Employee
Splunk Employee

If the maxVolumeDataSizeMB reaches the hot/warm bucket with the least latest value of latest-time is moved to colddb, the same applies to cold buckets if it happens to the volume:secondary, until the volume is below the maximum size.
- A warm bucket will be pushed to cold (chilled)
- A cold bucket will be pushed to frozen

As of this writing this trim operation, scheduling bucket movement will stop working if the minFreeSpace, 5GB by default is once hit, which will make the situation worse. - This will be enhanced in 6.3.

Also make sure to take this into account, by default, report acceleration summaries can theoretically take up an unlimited amount of disk space. This can be a problem if you're also locking down the maximum data size of your indexes or index volumes. Find the details from the link below;
http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Manageacceleratedsearchsummaries#Configu...

IamaRobot
New Member

Is there any place in the official Splunk documentation where this answer is spelled out?

0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...