Getting Data In

why my indexers are indexing more than the hotdata maxVolumeDataSizeMB

skuma30
New Member

Hi,

I'm facing some issue that our indexers are not following the local indexes.conf settings in my local indexes.conf I mentioned that volume hot data as follows :-
[volume:hot]
path = /hotdata
maxVolumeDataSizeMB = 831544
but it is still indexing more than 1TB of hotdata not rolling back to the colddata folders.
Can any one please let us know what necessary steps to avoid this more indexing in the hotdata.

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have set the homePath of each index to use that volume of hot?
Furthermore are you using data model acceleration? If so have you changed tstatsHomePath or is that also going to this same directory of /hotdata ?

0 Karma

skuma30
New Member

@garethatiag Not for the each index specified for all in the indexes.conf. And we are not using datamodel acceleration. And should I mention for the all indexes in the indexes.conf to follow this hot folder that makes for each index will reach to that limit to roll to the coldfolder right please address me if iam wrong.

0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have something like this ?
homePath = volume:hot/$_index_name/db
coldPath = volume:cold/$_index_name/colddb

Your index needs to use the volume you have specified if you want the volume settings to work as per the indexes.conf documentation

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...