What will break if I set coldPath to /dev/null?

richgalloway · ‎04-11-2016

I've been asked to size a Splunk installation with only 30 days of hot/warm data - no cold data. I've never heard of this before. I could probably set coldPath=/dev/null so warm data is deleted instead of being moved to cold, but can Splunk handle that?

---
If this reply helps you, Karma would be appreciated.

twinspop · ‎04-11-2016

Just set maxTotalDataSizeMB and homePath.maxDataSizeMB to the same amount. No need for shenanigans with the locations.

[someindex]
maxTotalDataSizeMB     = 100000
homePath.maxDataSizeMB = 100000
frozenTimePeriodInSecs = 2592000

edit - added your 30 day limit

What will break if I set coldPath to /dev/null?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation

What will break if I set coldPath to /dev/null?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent