Splunk Enterprise

Best Practice Indexer configuration for Warm Volume only (no cold) and no age/time-based settings?

Noah_Woodcock
Path Finder

I am confused by some of the indexes.conf settings and how they interact. I believe that my desire is commonplace and straightforward but I keep hitting problems. I will reduce things to the simplest possible state with round numbers (this is not my actual situation but if I get a good answer here, I can take it from there):

I have a single indexer.
It has a single hot volume of 50GB.
This volume is mounted at /mnt/splunkhot.
I have no need for cold/frozen volumes.
I have no need to roll buckets based on time.
I would like to use all of my space and have it auto-roll the oldest buckets to make room for new buckets.
I have 3 index values.
The firewall index should never consume more than 70% of the entire volume (protect other index values from premature rotation if this index blows up for some reason)
The wineventlog index and os index should never consume more than 20% of the entire volume respectively.
When we grow the /mnt/splunkhot volume group, we would like to change as few configuration files as possible (so configurations with percentages are ideal, but mostly everything seems to be mb).
I know that the indexers require at least 50MB free on the hot volume or they will stop indexing so the configurations need to ensure this is always OK.
Ideally, I'd like the colddb to be alongside the db directory (in /mnt/splunkhot) but never ever be used, but not if it makes things more complicated.
This is linux so linking things to /dev/null is possible, if that makes things easier (i.e. the "no cold volume required" part).

Now that we have that configuration, let's say we double the disk space by adding another volume to the volume group. What settings should change and how?
If I add another index value, what should change and how?

Tags (1)
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...