topic Re: Hot bucket max time in Getting Data In

What is the hot bucket max time?

debjit_k — Thu, 14 Apr 2022 16:21:33 GMT

Hi All

I'm very new to Splunk can someone help me after how many days the data will transfer from hot bucket to warm bucket.

Note: default is 90 days that I know but I want proof which I need to show so can someone guide me from where I could find this.

Thank you in advance!!

Re: Hot bucket max time

PickleRick — Thu, 14 Apr 2022 12:58:27 GMT

It is not that straightforward.

There is indeed a setting maxHotSpanSecs which sets _maximum_ timespan of a bucket but the bucket might be rolled out to warm in certain circumstances (if you have maxHotIdleSecs parameter set and you don't receive events for that period of time, if it reaches its size limit or when the indexer is restarted).

So the maxHotSpanSecs is the theoretical maximum "age" of a hot bucket.

You might want to read the docs for indexes.conf file.

Re: Hot bucket max time

venky1544 — Thu, 14 Apr 2022 13:31:56 GMT

Hi @debjit_k

Hot buckets roll to warm bucket when they reach max size and timespan

also they roll to warm when indexer is restarted or 24 hours with no events written to the hot bucket

so if you want to demonstrate you can follow the steps in the link and tweak it according to your use case

https://www.batchworks.de/manually-roll-buckets-from-hot-to-warm/

in my scenario i noted the splunk bucket details in the hot bucket did a restart of the indexer and saw the bucket rolling to warm bucket

Hope this helps

Note: if this helps karma points are appreciated / if it really worked for you please the accept the solution it might help others