hot/warm buckets

pbrinkman — Wed, 12 Jun 2019 12:07:10 GMT

hi all,

I have seperate drive for my hot/warm and cold data.
The hot/warm drive is near capacity.

Looking to find an easy way to calculate how much data each index will hold.
One example index config set is as below

10955Mb ingest per day (10.9Gb)
MazDataSize = 750mb (max size in MB for a hot bucket to reach before it rolls to warm)
maxWarmDBCount = 436 (max number of warm buckets)
maxtotalDataSize = 4328249mb (4328Gb) (maximum size of the index (in Mb)
frozenTimePeriodinSecs = 34128000 (395days in seconds)(number of seconds after which indexed data rolls to frozen)
overall retention = 395 (13months)
overall warm in days = 30

I would like to know how i can work out what size this indexed data should take up on my hot/warm and cold drives.
The split of the 4328Gb between the hot/warm & cold drives over 13months.
Does anyone know how best to calculate this ?

Cheers
Paul

Re: hot/warm buckets

harsmarvania57 — Wed, 12 Jun 2019 13:06:40 GMT

Hi,

Have you looked at https://splunk-sizing.appspot.com/, it will be a good starting point.

Re: hot/warm buckets

kmorris_splunk — Wed, 12 Jun 2019 13:40:07 GMT

I was just about to share the same thing. This is a great tool for this task. You can play around with different retention times for hot/warm, cold, and archived (frozen).

topic Re: hot/warm buckets in Getting Data In

hot/warm buckets

Re: hot/warm buckets

Re: hot/warm buckets