Why are indexes with hot/warm and cold paths on volumes showing as empty in dbinspect?

[brettwilliams]

This seems weird. My index clusters (dev, qa, and production environments) seem to be completely ignoring my indexes configuration.

The sizeOnDiskMB value for indexes in /opt/splunk shows values as expected. And when I tweaked my indexes.conf, the cluster dutifully froze buckets. But for indexes with hot/warm and cold volumes, sizeOnDeskMB is ZERO. Weird.

I'm on 7.0.7.

[brettwilliams]

So I might have answered this question with the help of Splunk support. We'll know after our maintenance window this afternoon.

In short, when we defined our volumes, we chose a path on the file system which contains a protected keyword which is present in code. In our case, we chose /splunkdb-hot. And as it turns out, db-hot used to be part of the name of hot buckets in older versions of Splunk.

Will update again soon.