Without a tiered storage model it seems like there would be little argument for using cold/frozen storage. Except potentially if additional compression helps save space. If not, using only a homePath...
See more...
Without a tiered storage model it seems like there would be little argument for using cold/frozen storage. Except potentially if additional compression helps save space. If not, using only a homePath in indexes.conf would seem like it would make all data readily accesible as hot/warm. However, checking the documentation there seems to be three paths for indexes that are reqired for Splunkd to start being homePath, coldPatch and thawedPath. (indexes.conf - Splunk Documentation) So using a single disk/volume/mount, what does the inputs.conf look like? Should the same path just be set for all three? Making sure that maxVolumeDataSizeMB adds up to the total volume available on /data/splunk/warm. [volume:storage]
path = /data/splunk/warm/
# adjust when correct disk is mounted
maxVolumeDataSizeMB = 2800000
...
...
[volume:_splunk_summaries]
path = /data/splunk/warm/
# ~ 200GB
maxVolumeDataSizeMB = 200000
...
...
[main]
homePath = volume:storage/defaultdb/db
coldPath = volume:storage/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
[history]
homePath = volume:storage/historydb/db
coldPath = volume:storage/historydb/colddb
thawedPath = $SPLUNK_DB/historydb/thaweddb
[summary]
homePath = volume:storage/summarydb/db
coldPath = volume:storage/summarydb/colddb
thawedPath = $SPLUNK_DB/summarydb/thaweddb
...
...
[windows]
homePath = volume:storage/windows/db
coldPath = volume:storage/windows/colddb
summaryHomePath = volume:storage/windows/summary
thawedPath = $SPLUNK_DB/windows/thaweddb
tstatsHomePath = volume:_splunk_summaries/windows/datamodel_summary
frozenTimePeriodInSecs = 63072000
[linux]
homePath = volume:storage/linux/db
coldPath = volume:storage/linux/colddb
summaryHomePath = volume:storage/linux/summary
thawedPath = $SPLUNK_DB/linux/thaweddb
tstatsHomePath = volume:_splunk_summaries/linux/datamodel_summary
frozenTimePeriodInSecs = 63072000 I'm assuming this would work, right? Though as it seems that Splunk requires, and does make use of "cold" and "thawed" anyway, does it make more sence to just partition mounts for warm and cold separately anyway? [volume:warm]
path = /data/splunk/warm/
# adjust when correct disk is mounted
maxVolumeDataSizeMB = 500000
[volume:cold]
path = /data/splunk/warm/
# adjust when correct disk is mounted
maxVolumeDataSizeMB = 2500000
...
...
[volume:_splunk_summaries]
path = /data/splunk/warm/
# ~ 200GB
maxVolumeDataSizeMB = 200000
...
...
[main]
homePath = volume:warm/defaultdb/db
coldPath = volume:cold/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
[history]
homePath = volume:warm/historydb/db
coldPath = volume:cold/historydb/colddb
thawedPath = $SPLUNK_DB/historydb/thaweddb
[summary]
homePath = volume:warm/summarydb/db
coldPath = volume:cold/summarydb/colddb
thawedPath = $SPLUNK_DB/summarydb/thaweddb
...
...
[windows]
homePath = volume:warm/windows/db
coldPath = volume:cold/windows/colddb
summaryHomePath = volume:warm/windows/summary
thawedPath = $SPLUNK_DB/windows/thaweddb
tstatsHomePath = volume:_splunk_summaries/windows/datamodel_summary
frozenTimePeriodInSecs = 63072000
[linux]
homePath = volume:warm/linux/db
coldPath = volume:warm/linux/colddb
summaryHomePath = volume:warm/linux/summary
thawedPath = $SPLUNK_DB/linux/thaweddb
tstatsHomePath = volume:_splunk_summaries/linux/datamodel_summary
frozenTimePeriodInSecs = 63072000 Does it matter and what would be "best praxis".