All Apps and Add-ons

Two attributes defined in indexes.conf on cold bucket, which one supercedes the other

mmohiuddin
Path Finder

Hi

I have two attributes defined for cold buckets.

500 GB

coldPath.maxDataSizeMB = 512000

395 days

frozenTimePeriodInSecs = 34128000

Which one of the above attributes supersedes the other. I am afraid that if the frozenTime PeriodInSecs takes precedence that it will cause serious strain on disk storage and we might run out of disk space soon on the indexer.

Please let me know.

Thanks.

Tags (1)
0 Karma

OMohi
Path Finder

Thanks for your reply guys.

0 Karma

gfuente
Motivator

Hello

Both settings are applied, so as soon as any of them reaches the limit defined, it will start to roll out to frozen the buckets.

In the other hand, it could happen that if your indexed data grows to 500GB in just one month, then it will start to roll to frozen and you wont have the 1 year data retention desired.

Regards

0 Karma

schoi
Splunk Employee
Splunk Employee

Both settings take effect -- so if either of those conditions are met, buckets will start to freeze.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...