Getting Data In

why my indexers are indexing more than the hotdata maxVolumeDataSizeMB

skuma30
New Member

Hi,

I'm facing some issue that our indexers are not following the local indexes.conf settings in my local indexes.conf I mentioned that volume hot data as follows :-
[volume:hot]
path = /hotdata
maxVolumeDataSizeMB = 831544
but it is still indexing more than 1TB of hotdata not rolling back to the colddata folders.
Can any one please let us know what necessary steps to avoid this more indexing in the hotdata.

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have set the homePath of each index to use that volume of hot?
Furthermore are you using data model acceleration? If so have you changed tstatsHomePath or is that also going to this same directory of /hotdata ?

0 Karma

skuma30
New Member

@garethatiag Not for the each index specified for all in the indexes.conf. And we are not using datamodel acceleration. And should I mention for the all indexes in the indexes.conf to follow this hot folder that makes for each index will reach to that limit to roll to the coldfolder right please address me if iam wrong.

0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have something like this ?
homePath = volume:hot/$_index_name/db
coldPath = volume:cold/$_index_name/colddb

Your index needs to use the volume you have specified if you want the volume settings to work as per the indexes.conf documentation

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...