https://community.splunk.com/t5/Deployment-Architecture/differences-between-warm-and-cold-buckets/m-p/104389#M3872 <P>Accepting this answer, since it more or less answered what I asked. Though, technically the only real difference seems to be location. Splunk rolls warm-to-cold based on age, but there's nothing in the structure of the buckets that would prevent manually moving one to the other, for instance. The real benefit of warm-to-cold would be in the ability to use less-expensive / slower storage for cold buckets which, in theory, would need to be accessed less often.</P> Mon, 09 Apr 2012 14:54:25 GMT jeff 2012-04-09T14:54:25Z https://community.splunk.com/t5/Deployment-Architecture/differences-between-warm-and-cold-buckets/m-p/104387#M3870 <P>In Splunk 4.3 (if it matters), besides it's location, is there any difference between a warm and a cold index bucket? Either in its structure or in how Splunk accesses/searches/processes them?</P> Thu, 29 Mar 2012 14:42:29 GMT https://community.splunk.com/t5/Deployment-Architecture/differences-between-warm-and-cold-buckets/m-p/104387#M3870 jeff 2012-03-29T14:42:29Z https://community.splunk.com/t5/Deployment-Architecture/differences-between-warm-and-cold-buckets/m-p/104388#M3871 <P>Both warm and cold buckets are searchable; the differences are location and age. You configure the thresholds in <CODE>indexes.conf</CODE>. See <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/HowSplunkstoresindexes">How Splunk stores indexes</A> and <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Backupindexeddata">Back up indexed data</A> in the documentation for more information.</P> Thu, 29 Mar 2012 15:12:24 GMT https://community.splunk.com/t5/Deployment-Architecture/differences-between-warm-and-cold-buckets/m-p/104388#M3871 ChrisG 2012-03-29T15:12:24Z https://community.splunk.com/t5/Deployment-Architecture/differences-between-warm-and-cold-buckets/m-p/104389#M3872 <P>Accepting this answer, since it more or less answered what I asked. Though, technically the only real difference seems to be location. Splunk rolls warm-to-cold based on age, but there's nothing in the structure of the buckets that would prevent manually moving one to the other, for instance. The real benefit of warm-to-cold would be in the ability to use less-expensive / slower storage for cold buckets which, in theory, would need to be accessed less often.</P> Mon, 09 Apr 2012 14:54:25 GMT https://community.splunk.com/t5/Deployment-Architecture/differences-between-warm-and-cold-buckets/m-p/104389#M3872 jeff 2012-04-09T14:54:25Z