Getting Data In
Highlighted

When the maxVolumeDataSizeMB for the primary volume is exceeded, will events automatically roll over to the secondary volume?

Champion

Hi,

When the maxVolumeDataSizeMB for the primary volume is exceeded, will the events automatically roll over to the secondary volume?

Here are my settings:

[volume:primary]
path = /apps/splunk/db

500GB

maxVolumeDataSizeMB = 500000
[volume:secondary]
path = /apps/splunk/colddb

# 5,000GB

maxVolumeDataSizeMB = 5000000

Highlighted

Re: When the maxVolumeDataSizeMB for the primary volume is exceeded, will events automatically roll over to the secondary volume?

Splunk Employee
Splunk Employee

If the maxVolumeDataSizeMB reaches the hot/warm bucket with the least latest value of latest-time is moved to colddb, the same applies to cold buckets if it happens to the volume:secondary, until the volume is below the maximum size.
- A warm bucket will be pushed to cold (chilled)
- A cold bucket will be pushed to frozen

As of this writing this trim operation, scheduling bucket movement will stop working if the minFreeSpace, 5GB by default is once hit, which will make the situation worse. - This will be enhanced in 6.3.

Also make sure to take this into account, by default, report acceleration summaries can theoretically take up an unlimited amount of disk space. This can be a problem if you're also locking down the maximum data size of your indexes or index volumes. Find the details from the link below;
http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Manageacceleratedsearchsummaries#Configu...

Highlighted

Re: When the maxVolumeDataSizeMB for the primary volume is exceeded, will events automatically roll over to the secondary volume?

New Member

Is there any place in the official Splunk documentation where this answer is spelled out?

0 Karma
Highlighted

Re: When the maxVolumeDataSizeMB for the primary volume is exceeded, will events automatically roll over to the secondary volume?

SplunkTrust
SplunkTrust
0 Karma