Splunk Enterprise

What counts towards maxVolumeDataSizeMB?

spammenot66
Contributor

"total size of all databases that reside on this volume to the maximum size specified, in MB" >> What is meant by all databases? does it sum up the file size of all tsidx file?

OR

Does it include everything in an index/db folder, which would include bloomfilter, .lex & .data files and rawdata folder 

 

https://docs.splunk.com/Documentation/Splunk/latest/admin/Indexesconf

maxVolumeDataSizeMB = <positive integer>
* If set, this setting limits the total size of all databases that reside
  on this volume to the maximum size specified, in MB.  Note that this it
  will act only on those indexes which reference this volume, not on the
  total size of the path set in the 'path' setting of this volume.
* If the size is exceeded, splunkd removes buckets with the oldest value
  of latest time (for a given bucket) across all indexes in the volume,
  until the volume is below the maximum size. This is the trim operation.
  This can cause buckets to be chilled [moved to cold] directly
  from a hot DB, if those buckets happen to have the least value of
  latest-time (LT) across all indexes in the volume.

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

In this context, "database" means "index".

---
If this reply helps you, Karma would be appreciated.
0 Karma

spammenot66
Contributor

Ok but I’m trying to validate things maxVolumeDataSizeMB, so does it refer to everything under the index folder or just the tsidix files? 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...