Getting Data In

why my indexers are indexing more than the hotdata maxVolumeDataSizeMB

skuma30
New Member

Hi,

I'm facing some issue that our indexers are not following the local indexes.conf settings in my local indexes.conf I mentioned that volume hot data as follows :-
[volume:hot]
path = /hotdata
maxVolumeDataSizeMB = 831544
but it is still indexing more than 1TB of hotdata not rolling back to the colddata folders.
Can any one please let us know what necessary steps to avoid this more indexing in the hotdata.

Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have set the homePath of each index to use that volume of hot?
Furthermore are you using data model acceleration? If so have you changed tstatsHomePath or is that also going to this same directory of /hotdata ?

0 Karma

skuma30
New Member

@garethatiag Not for the each index specified for all in the indexes.conf. And we are not using datamodel acceleration. And should I mention for the all indexes in the indexes.conf to follow this hot folder that makes for each index will reach to that limit to roll to the coldfolder right please address me if iam wrong.

0 Karma

gjanders
SplunkTrust
SplunkTrust

So you have something like this ?
homePath = volume:hot/$_index_name/db
coldPath = volume:cold/$_index_name/colddb

Your index needs to use the volume you have specified if you want the volume settings to work as per the indexes.conf documentation

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...