Getting Data In

This volume configuration will *not* manage space used by this index

yannK
Splunk Employee
Splunk Employee

I have indexes configured with volumes and started to see this warning after upgrade to 6.*

10-16-2013 18:18:20.951 -0700 ERROR IndexConfig - idx=idx1 Path coldPath='/opt/splunk/var/lib/splunk/idx2/cold' (realpath '/opt/splunk/var/lib/splunk/idx1/cold') is inside volume=hot1 (path='/opt/splunk/var/lib/splunk/', realpath='/opt/splunk/var/lib/splunk'), but does not reference that volume.  Space used by coldPath will *not* be volume-mananged.  Config error?`

Myindexes.conf:

[volume:hot1]
path = /opt/splunk/var/lib/splunk/
maxVolumeDataSizeMB = 100000

[idx1]
homePath = volume:hot1/idx1hot
coldPath = $SPLUNK_DB/idx1cold
thawedPath=$SPLUNK_DB/idx1thawed
1 Solution

sowings
Splunk Employee
Splunk Employee

This warning would have appeared in 5 as well. It looks like your volume:hot1 path is the self-same as the default value of $SPLUNK_DB. By declaring this path the root of your volume, Splunk expects that all of the other indexes that are children of this path should be part of the volume as well.

Now take, for example, the coldPath you've provided: Since the coldPath is also a child of /opt/splunk/var/lib/splunk, but does not include a volume:hot1 tag in its definition, Splunk generate the warning you see. This means that the cold space for that index won't be subject to maxVolumeDataSizeMB.

View solution in original post

sowings
Splunk Employee
Splunk Employee

This warning would have appeared in 5 as well. It looks like your volume:hot1 path is the self-same as the default value of $SPLUNK_DB. By declaring this path the root of your volume, Splunk expects that all of the other indexes that are children of this path should be part of the volume as well.

Now take, for example, the coldPath you've provided: Since the coldPath is also a child of /opt/splunk/var/lib/splunk, but does not include a volume:hot1 tag in its definition, Splunk generate the warning you see. This means that the cold space for that index won't be subject to maxVolumeDataSizeMB.

sowings
Splunk Employee
Splunk Employee

And I'll note here that thawed is a) exempt from retention rules, volume based or no, and b) it cannot use a volume definition (perhaps because of a).

0 Karma

yannK
Splunk Employee
Splunk Employee

The issue was that $SPLUNK_DB and volume:hot1 were pointing to the same exact folder, therefore the size limits were not considering all the subfolders of this location using the same approach.

I fixed the warming message by using the volume for my hot/cold, and any othr indexed that were using $SPLUNK_DB

`[volume:hot1]
path = /opt/splunk/var/lib/splunk/
maxVolumeDataSizeMB = 100000

[idx1]
homePath = volume:hot1/idx1hot
coldPath = volume:hot1/idx1cold
thawedPath=$SPLUNK_DB/idx1thawed
`

0 Karma

mkelderm
Path Finder

Thanks for the answer! You are right about $SPLUNK_DB. I will change that. But meanwhile, this "ERROR" is really not an error?

0 Karma

sowings
Splunk Employee
Splunk Employee

In my opinion, it's more of a warning. If your goal was to treat the location at /opt/splunk/var/lib/splunk as a "volume" (I tend to think of this as "partition", from my Unix-y background), then it's an alert that Splunk is not going to "Do What I Mean". It could manifest as an issue where data is archived sooner than expected or the disk partition is allowed to fill because some index paths were not part of the volume restriction.

0 Karma

mkelderm
Path Finder

Hi, same here since 6.0

10-25-2013 12:52:40.537 +0200 ERROR ProcessTracker - (child_27__Fsck) IndexConfig - idx=_audit Path coldPath='/data/splunkdb/audit/colddb' (realpath '/data/splunkdb/audit/colddb') is inside volume=splunkdb_warm (path='/data/splunkdb', realpath='/data/splunkdb'), but does not reference that volume. Space used by coldPath will not be volume-mananged. Config error?

Did you find a solution?

Marc

0 Karma

yannK
Splunk Employee
Splunk Employee

The issue was that $SPLUNK_DB and volume:hot1 were pointing to the same exact folder, therefore the size limits were not considering all the subfolders of this location using the same approach.
I fixed the warming message by using the volume for my hot/cold, and any othr indexed that were using $SPLUNK_DB

This is not an error, just a warning.

0 Karma

anupjishnu
Path Finder

I see this listed as error in 6.2 splunkd.log

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...