Splunk Search

Splunk volume exceeding maxVolumeDataSizeMb setting

rsantoso_splunk
Splunk Employee
Splunk Employee

The /volumes/summaries directory is the location of data model acceleration summaries:
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf [volume:_splunk_summaries]
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf path = /volumes/summaries/
/opt/splunk/etc/slave-apps/cluster/local/indexes.conf maxVolumeDataSizeMB = 95000

The volume on /volumes/summaries:
$ df -m
Filesystem 1M-blocks Used Available Use% Mounted on
/dev/sde 100664 100534 115 100% /volumes/summaries

As seen above, the volume should not exceed 95GB as per configured however it hitting the available volume 100G.

Error Messages:
ERROR SummarySizeManager - Cannot compute the summary size on path="/volumes/summaries//datamodel_summary/": No such file or directory

Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

Resolution is to reduce the size of maxVolumeDataSizeMB to lower value 90GB.

  1. maxVolumeDataSizeMB is not to be exactly the same measure of df/file system
  2. The Reason is that when calculating the size of bucket, splunk only add up the file size under the buckets. Directory is not counted. Suppose customer has a big number of buckets/directory, the margin between splunk and df measurement can be big. A normal directory size is 4K, if they have one million directory under the bucket directory, there would be 4GB gap.

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

Resolution is to reduce the size of maxVolumeDataSizeMB to lower value 90GB.

  1. maxVolumeDataSizeMB is not to be exactly the same measure of df/file system
  2. The Reason is that when calculating the size of bucket, splunk only add up the file size under the buckets. Directory is not counted. Suppose customer has a big number of buckets/directory, the margin between splunk and df measurement can be big. A normal directory size is 4K, if they have one million directory under the bucket directory, there would be 4GB gap.
0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...