indexes.conf and volume settings

[pkeller]

I have a volume defined:

[volume:hot]
path = /indexes/warm
maxVolumeDataSizeMB = 2097152

[test]
homePath=volume:hot/test/db
coldPath=volume:cold/test/colddb
thawedPath=/indexes/cold/test/thaweddb
repFactor=autotestmaxDataSize = auto_high_volume

So ... I'd like this 'test' index to not be controlled by the 2Tb volume size limit, but I don't want to move it to another filesystem. The index is small, and I'd like to let it be grow to > 10Gb before it starts rolling over to cold ...

can I create another volume (on the same path)

[volume:test]
path = /indexes/warm
maxVolumeDataSizeMB = 10000

[test]
homePath=volume:test/test/db
coldPath=volume:test/test/colddb
thawedPath=/indexes/cold/test/thaweddb
repFactor=autotestmaxDataSize = auto_high_volume

Would that configuration make it so, when /indexes/warm reaches 2Tb, it will start moving older buckets to cold without touching the 'test' index?

Or, will this entirely mess things up.

Thank you

[hardikJsheth · Accepted solution]

This won't work , you can't have two stanza for same volume. Using two separate volumes for this would be best.

Also check out maxWarmDBCount option for your index.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Indexesconf

[pkeller]

Thank you. Much appreciated, and it's kinda what I figured ... but had to ask. 🙂