I am confused by some of the indexes.conf settings and how they interact. I believe that my desire is commonplace and straightforward but I keep hitting problems. I will reduce things to the simplest possible state with round numbers (this is not my actual situation but if I get a good answer here, I can take it from there):
I have a single indexer.
It has a single hot volume of 50GB.
This volume is mounted at /mnt/splunkhot.
I have no need for cold/frozen volumes.
I have no need to roll buckets based on time.
I would like to use all of my space and have it auto-roll the oldest buckets to make room for new buckets.
I have 3 index values.
The firewall index should never consume more than 70% of the entire volume (protect other index values from premature rotation if this index blows up for some reason)
The wineventlog index and os index should never consume more than 20% of the entire volume respectively.
When we grow the /mnt/splunkhot volume group, we would like to change as few configuration files as possible (so configurations with percentages are ideal, but mostly everything seems to be mb).
I know that the indexers require at least 50MB free on the hot volume or they will stop indexing so the configurations need to ensure this is always OK.
Ideally, I'd like the colddb to be alongside the db directory (in /mnt/splunkhot) but never ever be used, but not if it makes things more complicated.
This is linux so linking things to /dev/null is possible, if that makes things easier (i.e. the "no cold volume required" part).
Now that we have that configuration, let's say we double the disk space by adding another volume to the volume group. What settings should change and how?
If I add another index value, what should change and how?
