indexes.conf
[volume:hot]
path=/mnt/splunk/hot
maxVolumeDataSizeMB = 40
[volume:cold]
path = /mnt/splunk/cold
maxVolumeDataSizeMB = 40
[A]
homePath = volume:hot/A/db
coldPath = volume:cold/A/coldd...
See more...
indexes.conf
[volume:hot]
path=/mnt/splunk/hot
maxVolumeDataSizeMB = 40
[volume:cold]
path = /mnt/splunk/cold
maxVolumeDataSizeMB = 40
[A]
homePath = volume:hot/A/db
coldPath = volume:cold/A/colddb
maxDataSize = 1
maxTotalDataSizeMB = 90
thawedPath = $SPLUNK_DB/A/thaweddb
[_internal]
homePath = volume:cold/_internaldb/db
coldPath = volume:cold/_internaldb/colddb
thawedPath = $SPLUNK_DB/_internaldb/thaweddb
maxDataSize = 1
maxTotalDataSizeMB = 90 I collected data from each index, and the percentage stored in cold volume was A=30MB, _internaldb/db=10MB. This was understood to account for a larger percentage because the data volume and collection speed of the A index was larger and faster than that of _internal collection. If you stop collecting data from the A index and maintain data collection only for the _internal index, the old buckets in _internaldb/db will be moved to _internaldb/colddb in the order they were loaded in _internaldb/db, and will not be maintained in colddb in the order in which they were loaded in _internaldb/db, but will be immediately deleted. Additionally, data that existed in A/colddb is deleted in oldest order. I understood that the cold volume is limited to 40 and the cold volume is already full, so it will not be maintained in _internaldb/colddb and will be immediately deleted. However, why is the data in A/colddb deleted? Afterwards, when the A/colddb capacity reaches 20, A/colddb is not deleted. The behavior I expected was that if A/colddb capacity is deleted until it becomes 0, the old buckets in _internaldb/db would be moved to _internaldb/colddb and then maintained. I'm curious why the results are different from what I expected, and if maxTotalDataSizeMB is the same, the Volume maintains the same ratio.