Getting Data In

Can you set a maximum hot index size globally?

responsys_cm
Builder

We would like to use a combination of solid state drives for the hot index and slower, cheaper disk for the warm/cold buckets. Is there a way to tell Splunk that the total size of all hot indexes should not exceed a certain size and roll events when that size is reached?

Thanks.

Craig

Tags (1)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

You can make use of volume notation in indexes.conf for hot and warm. Note that hot and warm should be on the same path. As usual, there is more info here: http://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf

indexes.conf


[volume:hot1]
path = /mnt/fast_disk
maxVolumeDataSizeMB = 100000

[volume:cold1]
path = /mnt/big_disk

[idx1]
homePath = volume:hot1/idx1
coldPath = volume:cold1/idx1

[idx2]
homePath = volume:hot1/idx2
coldPath = volume:cold1/idx2


Hope it helps

please upvote if you find this answer useful

View solution in original post

_d_
Splunk Employee
Splunk Employee

You can make use of volume notation in indexes.conf for hot and warm. Note that hot and warm should be on the same path. As usual, there is more info here: http://docs.splunk.com/Documentation/Splunk/latest/Admin/indexesconf

indexes.conf


[volume:hot1]
path = /mnt/fast_disk
maxVolumeDataSizeMB = 100000

[volume:cold1]
path = /mnt/big_disk

[idx1]
homePath = volume:hot1/idx1
coldPath = volume:cold1/idx1

[idx2]
homePath = volume:hot1/idx2
coldPath = volume:cold1/idx2


Hope it helps

please upvote if you find this answer useful

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...