Advanced Deployments - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 351

For the rest of the space needed by these indexes, we will create companion
volume definitions on big_slow , thus:
[volume:two_year_cold]
#security and chat cold storage
path = /big_slow/two_year_cold
maxVolumeDataSizeMB = 850000 #([security]+[chat])*1024 - 300000
[volume:one_year_cold]
#web_summary cold storage
path = /big_slow/one_year_cold
maxVolumeDataSizeMB = 230000 #[web_summary]*1024 - 150000
Now for our remaining indexes, whose timeframe is not important, we will
use big_fast and the remainder of big_slow , thus:
[volume:large_home]
#web and app home storage
path = /big_fast/large_home
maxVolumeDataSizeMB = 900000 #leaving 10% for pad
[volume:large_cold]
#web and app cold storage
path = /big_slow/large_cold
maxVolumeDataSizeMB = 3700000
#(big_slow - two_year_cold - one_year_cold)*.9
Given the sum of large_home and large_cold is 4,600,000 MB, and a combined
daily volume of approximately web and app is 60,000 MB, we should retain
approximately 153 days of web and app logs with 50 percent compression.
In reality, the number of days retained will probably be larger.
With our volumes defined, we now have to reference them in our index definitions:
[web]
homePath = volume:large_home/web
coldPath = volume:large_cold/web
thawedPath = /big_slow/thawed/web
[security]
homePath = volume:two_year_home/security
coldPath = volume:two_year_cold/security
thawedPath = /big_slow/thawed/security