Getting Data In

why my indexers are indexing more than the hotdata maxVolumeDataSizeMB

skuma30
New Member

Hi,

I'm facing some issue that our indexers are not following the local indexes.conf settings in my local indexes.conf I mentioned that volume hot data as follows :-
[volume:hot]
path = /hotdata
maxVolumeDataSizeMB = 831544
but it is still indexing more than 1TB of hotdata not rolling back to the colddata folders.
Can any one please let us know what necessary steps to avoid this more indexing in the hotdata.

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have set the homePath of each index to use that volume of hot?
Furthermore are you using data model acceleration? If so have you changed tstatsHomePath or is that also going to this same directory of /hotdata ?

0 Karma

skuma30
New Member

@garethatiag Not for the each index specified for all in the indexes.conf. And we are not using datamodel acceleration. And should I mention for the all indexes in the indexes.conf to follow this hot folder that makes for each index will reach to that limit to roll to the coldfolder right please address me if iam wrong.

0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have something like this ?
homePath = volume:hot/$_index_name/db
coldPath = volume:cold/$_index_name/colddb

Your index needs to use the volume you have specified if you want the volume settings to work as per the indexes.conf documentation

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...