When the maxVolumeDataSizeMB for the primary volume is exceeded, will events automatically roll over to the secondary volume?

[a212830]

Hi,

When the maxVolumeDataSizeMB for the primary volume is exceeded, will the events automatically roll over to the secondary volume?

Here are my settings:

[volume:primary]
path = /apps/splunk/db

500GB

maxVolumeDataSizeMB = 500000
[volume:secondary]
path = /apps/splunk/colddb

# 5,000GB

maxVolumeDataSizeMB = 5000000

[sylim_splunk]

If the maxVolumeDataSizeMB reaches the hot/warm bucket with the least latest value of latest-time is moved to colddb, the same applies to cold buckets if it happens to the volume:secondary, until the volume is below the maximum size.
- A warm bucket will be pushed to cold (chilled)
- A cold bucket will be pushed to frozen

As of this writing this trim operation, scheduling bucket movement will stop working if the minFreeSpace, 5GB by default is once hit, which will make the situation worse. - This will be enhanced in 6.3.

Also make sure to take this into account, by default, report acceleration summaries can theoretically take up an unlimited amount of disk space. This can be a problem if you're also locking down the maximum data size of your indexes or index volumes. Find the details from the link below;
http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Manageacceleratedsearchsummaries#Configu...

[IamaRobot]

Is there any place in the official Splunk documentation where this answer is spelled out?

[gjanders]

I believe Configure index storage and a Set a Retirement and Archiving Policy covers this...