Splunk Search

Splunk volume exceeding maxVolumeDataSizeMb setting

rsantoso_splunk
Splunk Employee
Splunk Employee

The /volumes/summaries directory is the location of data model acceleration summaries:
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf [volume:_splunk_summaries]
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf path = /volumes/summaries/
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf maxVolumeDataSizeMB = 95000

The volume on /volumes/summaries:
$ df -m
Filesystem 1M-blocks Used Available Use% Mounted on
/dev/sde 100664 100534 115 100% /volumes/summaries

As seen above, the volume should not exceed 95GB as per configured however it hitting the available volume 100G.

Error Messages:
ERROR SummarySizeManager - Cannot compute the summary size on path="/volumes/summaries//datamodel_summary/": No such file or directory

Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

Resolution is to reduce the size of maxVolumeDataSizeMB to lower value 90GB.

  1. maxVolumeDataSizeMB is not to be exactly the same measure of df/file system
  2. The Reason is that when calculating the size of bucket, splunk only add up the file size under the buckets. Directory is not counted. Suppose customer has a big number of buckets/directory, the margin between splunk and df measurement can be big. A normal directory size is 4K, if they have one million directory under the bucket directory, there would be 4GB gap.

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

Resolution is to reduce the size of maxVolumeDataSizeMB to lower value 90GB.

  1. maxVolumeDataSizeMB is not to be exactly the same measure of df/file system
  2. The Reason is that when calculating the size of bucket, splunk only add up the file size under the buckets. Directory is not counted. Suppose customer has a big number of buckets/directory, the margin between splunk and df measurement can be big. A normal directory size is 4K, if they have one million directory under the bucket directory, there would be 4GB gap.
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...