Storage issues on indexer

Reethika — Mon, 22 Jun 2020 08:55:50 GMT

Is it normal to have colddb > db?

4.0K    thaweddb
20M     summary
4.2G    datamodel_summary
9.8G    db
59G     colddb
[root@xxxxxxxplunkdata/_internaldb

Re: Storage issues on indexer

gcusello — Mon, 22 Jun 2020 09:04:23 GMT

it depends on the parameters you configured in your Splunk installation,

as you can see in https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf there are many parameters to configure how long a bucket remains in Warm Data (db) and how long it remains in Cold Data (colddb).

at first, what's the retention of your archive? if you have a long retention (frozenTimePriodInSeconds), buckets stay most time in Cold State.

if you leave the the number of warm as default and you have many data, the pass quickly from Warm to Cold (default of maxWarmDbCount is 300).

In other words it's normal, unless you setted a different configuration.

Ciao.

Giuseppe