OK. I understand your point but if you wanted to move this storage to another place you could as well simply move the coldPath around since you will have to move the contents manually anyway. And it will be bothersome in clustered environment. But in your case - well, you're effectively trying to ask splunk to do two opposite things - limit the data and don't limit the data. 😉 Splunk doesn't care that your both volumes are on the same physical storage so it applies the volume limit as it's supposed to. What you could do - two possible approaches 1) Just set the "warm volume" limit to the whole 100GB and set "cold volume" limit to some negligible amount. Not a very pretty solution. Also the volume limits are supposed to be a "safeguards" for storage size, not a typical way of managing buckets life cycle. Especially if you want to have separate tiers for hot/warm and cold since exceeding volume size can immediately move buckets from hot to cold skipping warm completely. Depending on the activity in your indexes that might not be what you want 2) Set limits for homePath for indexes to a "normal" values and set limit for coldPath to some negligible amount. This way as soon as the bucket rotates to cold, it will be pushed out due to size limits (I'm not sure if it will be rolled out immediately or whether it would have to wait for another housekeeping cycle - by default 60 seconds).
... View more
