Are the hot/warm buckets required to be on a separate volume from the cold?
Or, can I set just one volume and have hot, warm and cold all going there?
Example:
[volume:data]
path = /data/splunk
maxVolumeDataSizeMB = 40960
[_audit]
homePath = volume:data/audit/db
coldPath = volume:data/audit/colddb
thawedPath = /data/splunk/audit/thaweddb
Thanks
Yes. The same disk limit will apply to all indexes, and all paths, hot/warm and cold.
Note that when size-based restrictions are applied, the oldest bucket in the index is culled. When using volume-based size restrictions, the oldest bucket in any index is frozen, so it might make sense to also apply time-based rules to keep your fast-growing sources in line.