moving data from hot/warm to cold DB

[KhalidAlharthi]

i'm facing problem with the storage of splunk i tried multiple way to minimize the heavy data stored at hot/warm DB but nothing went ok since the cold data won't accept and migartions from the hot/warm data

KhalidAlharthi_0-1721120975655.png

any suggestions?

[jotne]

Make sure all you path are correct.   Has this worked before?

You should also set the hot volume  to not be able to take all the disk volume.

Eks if you have 2TB of Hot/Warm disk, use some like this:

[volume:hot]
path = /data/splunk/index/hot/vol
maxVolumeDataSizeMB = 1900000

[KhalidAlharthi]

@jotne thank you for your assistance,

i'm afraid that's will cause issues with my data inside the indexers already.

so is this affect the data stored or by any meaning the data it self?