All,
Can you do a quick peer review of my index config here?
My expectation is we can save as much as we want, but once we go over 1/2TB, older buckets will get dropped. Indexing, however, will never stop, giving my user 1/2TB to use how he pleases.
[volume:akamaidisk]
path = /akamaidata
maxVolumeDataSizeMB = 500000
[akamai2]
homePath=volume:akamaidisk/akamai2/db
coldPath=volume:akamaidisk/akamai2/colddb
thawedPath=$SPLUNK_DB/akamai2/thaweddb
maxDataSize=auto_high_volume
The 1/2 TB limitation is configurable - it's the default max size of an index - you can change it if you like.
It's maxTotalDataSizeMB
and the following thread speaks about it - how to manage the size of my indexes to fit in my volumes.