Advanced Deployments - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 350

Using volumes to manage multiple indexes
Volumes combine pools of storage across different indexes so that they age
out together. Let's make up a scenario where we have five indexes and three
storage devices.

The indexes are as follows:

Name Data per day Retention required Storage needed

web 50 GB no requirement ?

security

1 GB 2 years 730 GB * 50 percent

app

10 GB no requirement ?

chat 2 GB 2 years 1,460 GB * 50

percent

web_summary 1 GB 1 years 365 GB * 50 percent

Now let's say we have three storage devices to work with, mentioned in the
following table:

Name Size

small_fast 500 GB

big_fast 1,000 GB

big_slow 5,000 GB

We can create volumes based on the retention time needed. security and
chat share the same retention requirements, so we can place them in the
same volumes. We want our hot buckets on our fast devices, so let's start
there with the following configuration:

[volume:two_year_home]
#security and chat home storage
path = /small_fast/two_year_home
maxVolumeDataSizeMB = 300000

[volume:one_year_home]
#web_summary home storage
path = /small_fast/one_year_home
maxVolumeDataSizeMB = 150000