Splunk summery volume

[m_zandinia]

Hi Splunkers! I hope you all are doing well.

This is my indexes.conf

My problem is that the COLD volume was fulled.

This is the output of df command

The fs of COLD volume is xfs

Do you know that the total maxsize of both COLD and splunk_summareis must not exceed from total space or Just setting the COLD volume is enough because the splunk_summaries volume is part of that?

I mean in my case Splunk set the addition of both volume:COLD and volume:_splunk_summaries for total space for storing buckets or just set the maxVolumesize of volume:COLD config?

 Thanks in advance for any advice

PS: I know Splunk do recommend that the summaries must be stored in HOT volume!

[PickleRick]

Let's see in the docs:

maxVolumeDataSizeMB = <positive integer>
* If set, this setting limits the total size of all databases that reside
  on this volume to the maximum size specified, in MB.  Note that this it
  will act only on those indexes which reference this volume, not on the
  total size of the path set in the 'path' setting of this volume.

In other words, the limit for your COLD volume limits only cumulative size of databases directly referencing this volume. The _splunk_summaries volume has its own independent limit. So effectively you may grow your /Splunk-Storage/COLD directory up to 4674000MB (probably a bit more, considering some metadata overhead and so on)