Leverage your monitoring console as the easy method to check volume sizes on each of your indexers. Ideally the total space should be absolutely identical across all indexers, ie 100MB x 8idx/site x 2 sites (completely made up numbers). | rest splunk_servers=* /services/data/index-volumes Run that SPL on your search head and it will return for all servers in your search cluster and indexing cluster. You can add more search terms to get down to the indexer level and then transform the results for "/dataHot", "/dataCold", and "_splunk_summaries". Look at the per server results for used vs available/total and create a calculated field for %used. Anything above 85% for /dataCold is typically a strong indication you need to expand your storage capabilities. Note that "/dataHot" by design runs full before it will roll a bucket over to the /dataCold volume.
... View more
