I have one question about ITSI indexes.
Our Splunk Indexer has 1 disk “fast” and 1 disk “slow” with more capacity (it is not that slow but performance are lower than the fast one). On the “fast” hot and warm buckets are present, instead on the “slow” cold buckets are there. This set-up is valid for all of our indexes, except for Splunk ITSI ones.
In fact currently Splunk ITSI has reached 30GB in our "fast" disk (with approximately more than 1 year of data) and I would like to set-up a limit of 20GB on “fast” disk
volume:home and the rest on the “slow” one
We don’t usually inquiry data older than 1 month with ITSI.
I would like to change indexes.conf configuration as follow:
[itsi_summary] homePath = volume:home/itsi_summary/db coldPath = volume:home/itsi_summary/colddb thawedPath = $SPLUNK_DB/itsi_summary/thaweddb
[itsi_summary] homePath = volume:home/itsi_summary/db coldPath = volume:cold/itsi_summary/colddb thawedPath = $SPLUNK_DB/itsi_summary/thaweddb #added to limit index size on fast disk homePath.maxDataSizeMB = 20480
Do you see any contraindication on moving the coldPath from volume:home to volume:cold?
Thanks a lot,
Hot/warm and cold buckets can be in different volumes.
As per your use-case, 'coldPath' can be configured to slower disk.