nfs failure behaviors

[vbumgarner]

If you're using nfs for cold, and the nfs goes away for awhile, what happens?

What happens to rolling?

Does Splunk just sit on the buckets in hot/warm until it can copy them?

What about searches that involve these buckets that are now in limbo?

[dwaddle]

This probably depends, in part, on how your NFS is configured. An NFS hard mount that is unresponsive could freeze your splunkd -- or at least one or more threads -- until the NFS server does respond again. A soft mount would return an error back to splunk, which may be the more interesting case for your question.