How to reduce the hot volume size?

[nawazns5038]

Hi,

We are using volume partitions for the indexes.conf and the hot volume is getting full around 90% on the disk.

[volume:hotwarm]
path = /mnt/hot

[volume:cold]
path = /mnt/cold


[xxxxxx]
homePath = volume:hotwarm/xxxxxxxx/db
coldPath = volume:cold/xxxxxxx/colddb
thawedPath = $SPLUNK_DB/xxxxxxx/thaweddb
homePath.maxDataSizeMB = 2000000
coldPath.maxDataSizeMB = 15664000
frozenTimePeriodInSecs = 2160000
maxTotalDataSizeMB = 34664000
maxDataSize = auto_high_volume
repFactor = auto

This is the indexes.conf being used. Please suggest a method to reduce the hot volume size

In general, how to reduce the hot volume for an index.

[somesoni2]

*You can configure a maximum size for your hotwarm volume to ensure it never grows beyond that size. See this:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Configureindexstoragesize#Configure_index...

Basically in your homePath or hotwarm volume contains your hot buckets (default count 4) and warm buckets (default count 300)*. With your maxDataSize =auto_high_volume, each bucket (hot or warm) will be sufficiently large, hence your volume is full. So you can define max size for your homepath or hotwarm volumen (per above link) OR adjust your warm bucket count/sizes.

[nawazns5038]

Thanks @somesoni2
Adjusting the Warm bucket counts has solved the issue.
Didn't try the max volume setting

[somesoni2]

Cool.
Will there be any chance that your daily data might grow with time? If it does, you might want to keep a check on warm bucket counts as it may need adjustments with growing data.

[nawazns5038]

The index volume might be the same or increase a little bit , we might add new indexes which might increase the overall volume.

Suppose we put a limit of warm buckets to an index and it has increased the indexing volume, what would be the consequences and is it needed to increase or change the warm bucket count if there is increase or decrease the indexing volume for that index ?