Refine your search:

Is Splunk smart enough to recognize that main and others are included under the primary volume even when main's path doesn't reference the volume name?

In other words, is it necessary to re-define the values of homePath and coldPath for each index, or will it automatically freeze buckets from all indexes on the partition when the value of maxVolumeDataSizeMB is crossed?

In the example below, it seems like buckets in main should start to be frozen after the total usage crossed ~3 TB, but it isn't completely clear based on the documentation here and here.

# $SPLUNK_DB = /mnt/internal
[main]
homePath   = $SPLUNK_DB/defaultdb/db
coldPath   = $SPLUNK_DB/defaultdb/colddb

# Initial indexing location
[volume:primary]
path = /mnt/internal
maxVolumeDataSizeMB = 3000000

[index2]
homePath   = primary:/defaultdb/db
coldPath   = primary:/defaultdb/colddb

asked 21 Mar '11, 20:24

southeringtonp's gravatar image

southeringtonp ♦
4.5k1215
accept rate: 35%

Be the first one to answer this question!
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×34
×7

Asked: 21 Mar '11, 20:24

Seen: 624 times

Last updated: 21 Mar '11, 20:24

Copyright © 2005-2012 Splunk, Inc. All rights reserved.