topic Re: How to configure hot , warm and cold buckets in Getting Data In

How to configure hot, warm, and cold buckets?

power12 — Thu, 12 Jan 2023 18:08:48 GMT

Hello Splunkers ,

I have single machine splunk infrastructure. What stanzas I need to provide in indexes.conf for a index such that I need to have data in the below order

Hot / Warm = 14 days
Cold= 10 months

Frozen=1month

Also I have following questions

1.I see that hot are warm buckets are in the following location $SPLUNK_HOME/var/lib/splunk/defaultdb/db/*

How would we know or differentiate between hot and warm buckets or all look same?

2.Also once the policy of warm bucket is reached like the size or time will the cold location create by itself or should we create manually ($SPLUNK_HOME/var/lib/splunk/defaultdb/colddb/*)

I am pretty new to splunk so can you please help in what should be the stanzas that I should in order to achieve 14 days hot/warm and 10 months in cold and 1 month in frozen

3.what happens if we have a year worth of data in the hot/warm

4.How to back up data everyday?...should we copy the buckets everyday and store in a separate storage and if any disaster occurs if we place back the buckets from storage to warm and cold...will we see data as before?

Thanks,

mz9j

Re: How to configure hot , warm and cold buckets

RaviSingh — Thu, 12 Jan 2023 06:07:26 GMT

Buckets start rolling when they reach a specific size or age, whichever comes first.

You must set the size restriction high enough so that it is not a consideration in order to make time the only determining factor.

It is advantageous if your hot buckets are set up to just hold one day's worth of data.

Splunk does not manage frozen buckets. When they are eliminated, you decide (using cron, etc.).

I hope, it matches your requirements.

Thanks

Re: How to configure hot , warm and cold buckets

power12 — Thu, 12 Jan 2023 17:09:18 GMT

@RaviSingh Thank you for your reply....I was asking more about how to achieve the bucket size and time for an index..Iwant to know the configs or stanzas that needs in inputs.conf... your reply is more of generic