I've been asked to size a Splunk installation with only 30 days of hot/warm data - no cold data. I've never heard of this before. I could probably set coldPath=/dev/null
so warm data is deleted instead of being moved to cold, but can Splunk handle that?
Just set maxTotalDataSizeMB and homePath.maxDataSizeMB to the same amount. No need for shenanigans with the locations.
[someindex]
maxTotalDataSizeMB = 100000
homePath.maxDataSizeMB = 100000
frozenTimePeriodInSecs = 2592000