Getting Data In

why my indexers are indexing more than the hotdata maxVolumeDataSizeMB

skuma30
New Member

Hi,

I'm facing some issue that our indexers are not following the local indexes.conf settings in my local indexes.conf I mentioned that volume hot data as follows :-
[volume:hot]
path = /hotdata
maxVolumeDataSizeMB = 831544
but it is still indexing more than 1TB of hotdata not rolling back to the colddata folders.
Can any one please let us know what necessary steps to avoid this more indexing in the hotdata.

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have set the homePath of each index to use that volume of hot?
Furthermore are you using data model acceleration? If so have you changed tstatsHomePath or is that also going to this same directory of /hotdata ?

0 Karma

skuma30
New Member

@garethatiag Not for the each index specified for all in the indexes.conf. And we are not using datamodel acceleration. And should I mention for the all indexes in the indexes.conf to follow this hot folder that makes for each index will reach to that limit to roll to the coldfolder right please address me if iam wrong.

0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have something like this ?
homePath = volume:hot/$_index_name/db
coldPath = volume:cold/$_index_name/colddb

Your index needs to use the volume you have specified if you want the volume settings to work as per the indexes.conf documentation

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...