Getting Data In

indexes.conf and volume settings

pkeller
Contributor

I have a volume defined:

[volume:hot]
path = /indexes/warm
maxVolumeDataSizeMB = 2097152

[test]
homePath=volume:hot/test/db
coldPath=volume:cold/test/colddb
thawedPath=/indexes/cold/test/thaweddb
repFactor=autotestmaxDataSize = auto_high_volume

So ... I'd like this 'test' index to not be controlled by the 2Tb volume size limit, but I don't want to move it to another filesystem. The index is small, and I'd like to let it be grow to > 10Gb before it starts rolling over to cold ...

can I create another volume (on the same path)

[volume:test]
path = /indexes/warm
maxVolumeDataSizeMB = 10000

[test]
homePath=volume:test/test/db
coldPath=volume:test/test/colddb
thawedPath=/indexes/cold/test/thaweddb
repFactor=autotestmaxDataSize = auto_high_volume

Would that configuration make it so, when /indexes/warm reaches 2Tb, it will start moving older buckets to cold without touching the 'test' index?

Or, will this entirely mess things up.

Thank you

0 Karma
1 Solution

hardikJsheth
Motivator

This won't work , you can't have two stanza for same volume. Using two separate volumes for this would be best.

Also check out maxWarmDBCount option for your index.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Indexesconf

View solution in original post

0 Karma

hardikJsheth
Motivator

This won't work , you can't have two stanza for same volume. Using two separate volumes for this would be best.

Also check out maxWarmDBCount option for your index.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Indexesconf

0 Karma

pkeller
Contributor

Thank you. Much appreciated, and it's kinda what I figured ... but had to ask. 🙂

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...