Getting Data In

moving data from hot/warm to cold DB

KhalidAlharthi
Explorer

i'm facing problem with the storage of splunk i tried multiple way to minimize the heavy data stored at hot/warm DB but nothing went ok since the cold data won't accept and migartions from the hot/warm data

 

KhalidAlharthi_0-1721120975655.png

 

 

any suggestions?

Labels (2)
0 Karma

jotne
Builder

Make sure all you path are correct.   Has this worked before?

You should also set the hot volume  to not be able to take all the disk volume.

Eks if you have 2TB of Hot/Warm disk, use some like this:

[volume:hot]
path = /data/splunk/index/hot/vol
maxVolumeDataSizeMB = 1900000
0 Karma

KhalidAlharthi
Explorer

@jotne thank you for your assistance,

 

i'm afraid that's will cause issues with my data inside the indexers already.

 

so is this affect the data stored or by any meaning the data it self?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...