topic Re: maxHotSpanSecs in Getting Data In

maxHotSpanSecs

hjwang — Mon, 28 Sep 2020 11:27:37 GMT

Hi~splunkers

According to the spec in indexes.conf, it stats the maxHotSpanSecs is Upper bound of target max timespan of hot/warm buckets in seconds and defaults to 90 days, but i want to make sure if this means that the warm_bucket time span will be within this setting interval. Because i found some warm_bucket like db_lastest_earliest, its interval is more than 90 days.

thanks a lot.

Re: maxHotSpanSecs

jbsplunk — Wed, 29 Feb 2012 16:15:39 GMT

Data isn't written to warm buckets, it is only written to a bucket when it is hot. So that setting should take effect when data is hot and then the data would be rolled to warm, cold, frozen, etc.

Re: maxHotSpanSecs

hjwang — Thu, 01 Mar 2012 01:33:30 GMT

Does this mean one warm bucket can contain many hot rolled bucket? Because when maxHotSpanSecs set to 90 days, the hot bucket time span should not be more than 90 days, and it should be rolled to warm bucket. so I doubt why the warm bucket time span is more than 90 days

Re: maxHotSpanSecs

lguinn2 — Thu, 01 Mar 2012 18:23:14 GMT

No, a single hot bucket is "rolled" to a single warm bucket (via a simple filesystem rename).