topic Re: index setting in Splunk Enterprise

index setting

dall — Wed, 30 Dec 2020 07:38:37 GMT

hi In my index i have added this things

[ind1]

homePath= $SPLUNK_DB/ind1/db

coldPath= $SPLUNK_DB/ind1/colddb

thawedPath= $SPLUNK_DB/ind1/thaweddb

maxHotBuckets=10

maxDataSize=10000

maxWarmDBCount=300

maxTotalDataSizeMB=200000

frozenTimePeriodInSecs=31536000

coldToFrozenDir=$SPLUNK_DB/ ind1/frozendb

that means after 1 year data will be deleted ??

if i ll not add volume for this it ll affect my index or what???

please help on this

Re: index setting

scelikok — Wed, 30 Dec 2020 08:46:57 GMT

Hi @dall,

Since you defined coldToFrozenDir old data will not be deleted but move to coldToFrozenDir path.

Retention mechanism works according to two parameters. maxTotalDataSizeMB and frozenTimePeriodInSecs . Whichever hits first indexer will move oldest raw data to coldToFrozenDir path. It means if your index size goes over 200 GB before 1 year, raw data will be moved to coldToFrozenDir.

You should better change coldToFrozenDir to another disk or NFS path, because you will not free space.

If this reply helps you an upvote is appreciated.

Re: index setting

dall — Thu, 31 Dec 2020 05:54:30 GMT

if we ll not set coldtofrozendir data ll not move to that path and that ll deleted directly ??

or if ll mention that path that means that ll create a folder externally ??

Re: index setting

scelikok — Sun, 03 Jan 2021 05:49:19 GMT

Yes, both are correct @dall .

Also keep in mind if you restart the indexer hot buckets will roll to warm. So you may have some buckets that have less than 10 GB. But this will not change frozen process.