https://community.splunk.com/t5/Getting-Data-In/Hot-Bucket-Data-on-Splunk-Crash/m-p/97407#M20308 <P>You should typically not lose a hot bucket as the result of a Splunk crash. In 4.2, the "recoverable indexes" feature makes the bucket structure much more robust in the event of crashes and (some) disk/filesystem failures.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Recoverableindexes">http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Recoverableindexes</A></P> Tue, 25 Oct 2011 03:02:40 GMT dwaddle 2011-10-25T03:02:40Z https://community.splunk.com/t5/Getting-Data-In/Hot-Bucket-Data-on-Splunk-Crash/m-p/97406#M20307 <P>If Splunk Crashes will I lose everything that was being indexed in the Hot Bucket?.....is it safe to configure Splunk to roll straight to the Warm bucket more quickly during indexing?</P> <P>What is the best approach?</P> Tue, 25 Oct 2011 01:23:41 GMT https://community.splunk.com/t5/Getting-Data-In/Hot-Bucket-Data-on-Splunk-Crash/m-p/97406#M20307 Dark_Ichigo 2011-10-25T01:23:41Z https://community.splunk.com/t5/Getting-Data-In/Hot-Bucket-Data-on-Splunk-Crash/m-p/97407#M20308 <P>You should typically not lose a hot bucket as the result of a Splunk crash. In 4.2, the "recoverable indexes" feature makes the bucket structure much more robust in the event of crashes and (some) disk/filesystem failures.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Recoverableindexes">http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Recoverableindexes</A></P> Tue, 25 Oct 2011 03:02:40 GMT https://community.splunk.com/t5/Getting-Data-In/Hot-Bucket-Data-on-Splunk-Crash/m-p/97407#M20308 dwaddle 2011-10-25T03:02:40Z