indexes.conf - volume definitions: Mebi Or Megabytes?

[claudio_manig]

Hello Ninjas,

Does anybody have an idea of how to properly define a volume of 5TB of total storage in indexes.conf?

Technically, it should look like this:

[volume:hot1]
path = /mnt/fast_disk
maxVolumeDataSizeMB = 500000

As from a storage perspective, we use decimal separators from MB to TB and not the binary/mebi 1024. But some panels in the monitoring console made me struggle as the values do not sem to align with this logic.

So should it rather be:

    [volume:hot1]
    path = /mnt/fast_disk
    maxVolumeDataSizeMB = 5242880 

Using 1024 steps to calculate the 5 tb-

I havent found anything in the docs so anything official would be appreciated

Cheers
Claudio

[burwell]

Great question! I have always interpreted the units/setting to use 1024 bytes so I have always configured my maxVolumeDataSizeMB that way.

I would have thought your second answer is the correct way, maxVolumeDataSizeMB = 5242880, but I can't find anything in the Splexicon or other Splunk docs page.

Whenever there are any Splunk answers about MB etc people always divide by 1024. For example
https://answers.splunk.com/answers/4609/convert-bytes-to-megabytes-in-report.html