Help in Configuring Indexes.conf

pe_morris_ter — Tue, 29 Sep 2020 17:01:33 GMT

Hello Guys,

I am trying to configure the indexes.conf, Here is the scenario, I need to have hot bucket for 6 months, warm & cold to another 6 months, after one year the data must follow to frozen bucket. I have defined following settings. Does it comes under Splunk best practices, Below is my index setting

[volume:A]
maxVolumeDataSizeMB = 1000000

[test_index]
homePath = volume:A/test_index/db
coldPath = volume:A/test_index/colddb
thawedPath = $SPLUNK_DB/test_index/thawedd
maxHotBuckets = 10
maxDataSize = 15000
maxHotSpanSecs = 15760000
coldToFrozenDir = /path/
maxTotalDataSizeMB = 1000000
frozenTimePeriodInSecs = 31104000

Re: Help in Configuring Indexes.conf

vishaltaneja070 — Tue, 28 Nov 2017 13:25:29 GMT

Hi,

Above mentioned indexes.conf file looks fine. But in maxDataSize stanza you need to mention, the max data size is for which path, homepath(i.e. Hot and Warm) or coldpath(i.e. Cold )

Like homepath.maxDataSize=15000

Remaining things looks cool.

Thanks.

topic Help in Configuring Indexes.conf in Getting Data In

Help in Configuring Indexes.conf

Re: Help in Configuring Indexes.conf