Splunk Enterprise

How to fix Splunk indexers max volume size exceeded?

avivfri
Explorer

Hello

 

I have 5 indexers managed by Cluster Master.

On the indexes.conf (located as master-app) I have the following configuration:

 

[default]
maxTotalDataSizeMB = 1000000
frozenTimePeriodInSecs = 13824000

[volume:hot]
path = /hot/splunk_db/
maxVolumeDataSizeMB = 2800000

 

 

from my understating, the Hot volume on each indexer should not be more than 2.8TB. but, actually the volume exceeded this limit and reached 2.9TB. 

image.png

can someone please assist?

 

Thank you

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @avivfri,

remember that the passages from Hot to Warm, from Warm to Cold and from Cold to Frozen is always done at bucket level, this means that a full bucket passes from a state to another, not the single event data.

For the same reason it's normal to have data that exceeds the retention period, because they are in a buckets containing events in the retention period.

In other words, a bucket passes from Hot to Warm when all the events in the bucket exceeds the defined retention period or when the bucket is closed so it can change state.

In your case, probably you have buckets of 9.x GB, so they don't change status.

You could change the dimension of the buckets but I usually prefer to leave the default values.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @avivfri,

remember that the passages from Hot to Warm, from Warm to Cold and from Cold to Frozen is always done at bucket level, this means that a full bucket passes from a state to another, not the single event data.

For the same reason it's normal to have data that exceeds the retention period, because they are in a buckets containing events in the retention period.

In other words, a bucket passes from Hot to Warm when all the events in the bucket exceeds the defined retention period or when the bucket is closed so it can change state.

In your case, probably you have buckets of 9.x GB, so they don't change status.

You could change the dimension of the buckets but I usually prefer to leave the default values.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @avivfri,

good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉

0 Karma

avivfri
Explorer

Hi Giuseppe

Thank you for the detailed answer!

 

so you are saying that "frozenTimePeriodInSecs" takes priority over "maxVolumeDataSizeMB"?

 

Thank you

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @avivfri,

no there isn't any priority, I'm only saying that a full bucket rolls to another status, this means that the dimensions could exceed the configured limit.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...