Getting Data In

indexes.conf and volume settings

pkeller
Contributor

I have a volume defined:

[volume:hot]
path = /indexes/warm
maxVolumeDataSizeMB = 2097152

[test]
homePath=volume:hot/test/db
coldPath=volume:cold/test/colddb
thawedPath=/indexes/cold/test/thaweddb
repFactor=autotestmaxDataSize = auto_high_volume

So ... I'd like this 'test' index to not be controlled by the 2Tb volume size limit, but I don't want to move it to another filesystem. The index is small, and I'd like to let it be grow to > 10Gb before it starts rolling over to cold ...

can I create another volume (on the same path)

[volume:test]
path = /indexes/warm
maxVolumeDataSizeMB = 10000

[test]
homePath=volume:test/test/db
coldPath=volume:test/test/colddb
thawedPath=/indexes/cold/test/thaweddb
repFactor=autotestmaxDataSize = auto_high_volume

Would that configuration make it so, when /indexes/warm reaches 2Tb, it will start moving older buckets to cold without touching the 'test' index?

Or, will this entirely mess things up.

Thank you

0 Karma
1 Solution

hardikJsheth
Motivator

This won't work , you can't have two stanza for same volume. Using two separate volumes for this would be best.

Also check out maxWarmDBCount option for your index.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Indexesconf

View solution in original post

0 Karma

hardikJsheth
Motivator

This won't work , you can't have two stanza for same volume. Using two separate volumes for this would be best.

Also check out maxWarmDBCount option for your index.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Indexesconf

0 Karma

pkeller
Contributor

Thank you. Much appreciated, and it's kinda what I figured ... but had to ask. 🙂

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...