All Apps and Add-ons
Highlighted

Two attributes defined in indexes.conf on cold bucket, which one supercedes the other

Path Finder

Hi

I have two attributes defined for cold buckets.

500 GB

coldPath.maxDataSizeMB = 512000

395 days

frozenTimePeriodInSecs = 34128000

Which one of the above attributes supersedes the other. I am afraid that if the frozenTime PeriodInSecs takes precedence that it will cause serious strain on disk storage and we might run out of disk space soon on the indexer.

Please let me know.

Thanks.

Tags (1)
0 Karma
Highlighted

Re: Two attributes defined in indexes.conf on cold bucket, which one supercedes the other

Splunk Employee
Splunk Employee

Both settings take effect -- so if either of those conditions are met, buckets will start to freeze.

0 Karma
Highlighted

Re: Two attributes defined in indexes.conf on cold bucket, which one supercedes the other

Motivator

Hello

Both settings are applied, so as soon as any of them reaches the limit defined, it will start to roll out to frozen the buckets.

In the other hand, it could happen that if your indexed data grows to 500GB in just one month, then it will start to roll to frozen and you wont have the 1 year data retention desired.

Regards

0 Karma
Highlighted

Re: Two attributes defined in indexes.conf on cold bucket, which one supercedes the other

Path Finder

Thanks for your reply guys.

0 Karma