All Apps and Add-ons

Two attributes defined in indexes.conf on cold bucket, which one supercedes the other

mmohiuddin
Path Finder

Hi

I have two attributes defined for cold buckets.

500 GB

coldPath.maxDataSizeMB = 512000

395 days

frozenTimePeriodInSecs = 34128000

Which one of the above attributes supersedes the other. I am afraid that if the frozenTime PeriodInSecs takes precedence that it will cause serious strain on disk storage and we might run out of disk space soon on the indexer.

Please let me know.

Thanks.

Tags (1)
0 Karma

OMohi
Path Finder

Thanks for your reply guys.

0 Karma

gfuente
Motivator

Hello

Both settings are applied, so as soon as any of them reaches the limit defined, it will start to roll out to frozen the buckets.

In the other hand, it could happen that if your indexed data grows to 500GB in just one month, then it will start to roll to frozen and you wont have the 1 year data retention desired.

Regards

0 Karma

schoi
Splunk Employee
Splunk Employee

Both settings take effect -- so if either of those conditions are met, buckets will start to freeze.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...