Hi!
I would like to confirm which article is the correct explanation for maxTotalDataSizeMB.
In http://docs.splunk.com/Documentation/Splunk/5.0.5/Admin/Indexesconf,
it is described as
This paremeter only applies to hot, warm, and cold buckets. It does not apply to thawed buckets
But in http://docs.splunk.com/Documentation/Splunk/5.0.5/Indexer/Configureindexstorage,
it is described as
Determines rolling behavior, cold to frozen. The maximum size of an index. When this limit is reached, cold buckets begin rolling to frozen.
Which will be the correct explanation?
Thanks,
Yu Watanabe
I would say that there is no conflict between the definitions.
An index has (normally) hot, warm and cold buckets. The maxTotalDataSizeMB
parameter controls the combined size for all these buckets together. When size limit has been reached, the oldest cold
bucket is rolled to frozen
(and is no longer counted - regardless of whether this means deletion or archival).
If you have archived your frozen
buckets, and need to restore some of them (thawing
) at some later point in time, their restored size is not counted towards the maxTotalDataSizeMB
value. This makes quite good sense, since thawing 10 buckets would otherwise result in 10 cold buckets being frozen, automatically.
Hope this makes it a bit clearer.
/K
I would say that there is no conflict between the definitions.
An index has (normally) hot, warm and cold buckets. The maxTotalDataSizeMB
parameter controls the combined size for all these buckets together. When size limit has been reached, the oldest cold
bucket is rolled to frozen
(and is no longer counted - regardless of whether this means deletion or archival).
If you have archived your frozen
buckets, and need to restore some of them (thawing
) at some later point in time, their restored size is not counted towards the maxTotalDataSizeMB
value. This makes quite good sense, since thawing 10 buckets would otherwise result in 10 cold buckets being frozen, automatically.
Hope this makes it a bit clearer.
/K
Hello kristian.
I see. Now I understood.
Thanks,
Yu