topic Re: About maxTotalDataSizeMB in Security

About maxTotalDataSizeMB

yuwtennis — Tue, 08 Oct 2013 04:37:34 GMT

Hi!

I would like to confirm which article is the correct explanation for maxTotalDataSizeMB.

In http://docs.splunk.com/Documentation/Splunk/5.0.5/Admin/Indexesconf,
it is described as

This paremeter only applies to hot, warm, and cold buckets. It does not apply to thawed buckets

But in http://docs.splunk.com/Documentation/Splunk/5.0.5/Indexer/Configureindexstorage,
it is described as

Determines rolling behavior, cold to frozen. The maximum size of an index. When this limit is reached, cold buckets begin rolling to frozen.

Which will be the correct explanation?

Thanks,
Yu Watanabe

Re: About maxTotalDataSizeMB

kristian_kolb — Tue, 08 Oct 2013 05:57:37 GMT

I would say that there is no conflict between the definitions.

An index has (normally) hot, warm and cold buckets. The maxTotalDataSizeMB parameter controls the combined size for all these buckets together. When size limit has been reached, the oldest cold bucket is rolled to frozen (and is no longer counted - regardless of whether this means deletion or archival).

If you have archived your frozen buckets, and need to restore some of them (thawing) at some later point in time, their restored size is not counted towards the maxTotalDataSizeMB value. This makes quite good sense, since thawing 10 buckets would otherwise result in 10 cold buckets being frozen, automatically.

Hope this makes it a bit clearer.

Re: About maxTotalDataSizeMB

yuwtennis — Wed, 09 Oct 2013 09:44:17 GMT

Hello kristian.

I see. Now I understood.

Thanks,
Yu