https://community.splunk.com/t5/Splunk-Search/hot-v-file-not-found-but-able-to-see-file-using-locate/m-p/317959#M165530 <P>The digits at the end of the hot bucket directories are sequential numbers. Hot buckets are rolled to warm (db_*) based on index configuration parameters, or when you stop/restart splunk. So those hot bucket names change all the time as new data comes in.<BR /> defaultdb is (by default) mapped to the 'main' index. If you don't ingest any data here, you won't have hot buckets.<BR /> I would recommend you use the <A href="https://splunk-sizing.appspot.com/">Splunk Sizing Tool</A> to figure out what your storage requirements are.<BR /> Select your daily data volume, retention settings, etc. and it will give you an estimate on per-indexer and total data storage needs for HOT/WARM and COLD volumes.</P> Thu, 19 Oct 2017 07:22:24 GMT s2_splunk 2017-10-19T07:22:24Z https://community.splunk.com/t5/Splunk-Search/hot-v-file-not-found-but-able-to-see-file-using-locate/m-p/317958#M165529 <P>Hi,</P> <P>Referencing to <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Capacity/Estimateyourstoragerequirements" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.2.1/Capacity/Estimateyourstoragerequirements</A>, <BR /> I'm trying to estimate my storage space on Linux. At /opt/splunk/var/lib/splunk/defaultdb, when I run "du -ch hot_v*", terminal says no such file or directory. </P> <P>I did a locate hot_v and a list below came up and one of them in the db folder is hot_v1_12. <BR /> I then did a ls -a and I can't find hot_v1_12. </P> <P>Anyone encounter this issue before?</P> <P><IMG src="https://community.splunk.com/storage/temp/217902-capture.jpg" alt="alt text" /></P> Tue, 29 Sep 2020 16:20:36 GMT https://community.splunk.com/t5/Splunk-Search/hot-v-file-not-found-but-able-to-see-file-using-locate/m-p/317958#M165529 wuming79 2020-09-29T16:20:36Z https://community.splunk.com/t5/Splunk-Search/hot-v-file-not-found-but-able-to-see-file-using-locate/m-p/317959#M165530 <P>The digits at the end of the hot bucket directories are sequential numbers. Hot buckets are rolled to warm (db_*) based on index configuration parameters, or when you stop/restart splunk. So those hot bucket names change all the time as new data comes in.<BR /> defaultdb is (by default) mapped to the 'main' index. If you don't ingest any data here, you won't have hot buckets.<BR /> I would recommend you use the <A href="https://splunk-sizing.appspot.com/">Splunk Sizing Tool</A> to figure out what your storage requirements are.<BR /> Select your daily data volume, retention settings, etc. and it will give you an estimate on per-indexer and total data storage needs for HOT/WARM and COLD volumes.</P> Thu, 19 Oct 2017 07:22:24 GMT https://community.splunk.com/t5/Splunk-Search/hot-v-file-not-found-but-able-to-see-file-using-locate/m-p/317959#M165530 s2_splunk 2017-10-19T07:22:24Z