Getting Data In

indexes.conf and volume settings

pkeller
Contributor

I have a volume defined:

[volume:hot]
path = /indexes/warm
maxVolumeDataSizeMB = 2097152

[test]
homePath=volume:hot/test/db
coldPath=volume:cold/test/colddb
thawedPath=/indexes/cold/test/thaweddb
repFactor=autotestmaxDataSize = auto_high_volume

So ... I'd like this 'test' index to not be controlled by the 2Tb volume size limit, but I don't want to move it to another filesystem. The index is small, and I'd like to let it be grow to > 10Gb before it starts rolling over to cold ...

can I create another volume (on the same path)

[volume:test]
path = /indexes/warm
maxVolumeDataSizeMB = 10000

[test]
homePath=volume:test/test/db
coldPath=volume:test/test/colddb
thawedPath=/indexes/cold/test/thaweddb
repFactor=autotestmaxDataSize = auto_high_volume

Would that configuration make it so, when /indexes/warm reaches 2Tb, it will start moving older buckets to cold without touching the 'test' index?

Or, will this entirely mess things up.

Thank you

0 Karma
1 Solution

hardikJsheth
Motivator

This won't work , you can't have two stanza for same volume. Using two separate volumes for this would be best.

Also check out maxWarmDBCount option for your index.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Indexesconf

View solution in original post

0 Karma

hardikJsheth
Motivator

This won't work , you can't have two stanza for same volume. Using two separate volumes for this would be best.

Also check out maxWarmDBCount option for your index.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Indexesconf

0 Karma

pkeller
Contributor

Thank you. Much appreciated, and it's kinda what I figured ... but had to ask. 🙂

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...