Splunk volume exceeding maxVolumeDataSizeMb setting

[rsantoso_splunk]

The /volumes/summaries directory is the location of data model acceleration summaries:
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf [volume:_splunk_summaries]
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf path = /volumes/summaries/
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf maxVolumeDataSizeMB = 95000

The volume on /volumes/summaries:
$ df -m
Filesystem 1M-blocks Used Available Use% Mounted on
/dev/sde 100664 100534 115 100% /volumes/summaries

As seen above, the volume should not exceed 95GB as per configured however it hitting the available volume 100G.

Error Messages:
ERROR SummarySizeManager - Cannot compute the summary size on path="/volumes/summaries//datamodel_summary/": No such file or directory

[rsantoso_splunk · Accepted solution]

Resolution is to reduce the size of maxVolumeDataSizeMB to lower value 90GB.

1. maxVolumeDataSizeMB is not to be exactly the same measure of df/file system
2. The Reason is that when calculating the size of bucket, splunk only add up the file size under the buckets. Directory is not counted. Suppose customer has a big number of buckets/directory, the margin between splunk and df measurement can be big. A normal directory size is 4K, if they have one million directory under the bucket directory, there would be 4GB gap.