Deployment Architecture

Has maxColdDBCount been deprecated?

dah2016
Engager

So it appears that maxColdDBCount has been deprecated in 4.2.3. Is there replacement? Or should I just get rid off it? I was using it up to 4.1.7, just upgraded from that version.

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

maxColdDBCount never did anything from 4.0 on. It does not and never did (even under version 3.x) delete or remove buckets from the cold store. It was used purely for search and memory resource management internally in 3.x, and had no effect in 4.x and up.

To manage space used on the cold store, in 4.2.x, you can (and should) use the volume limit settings. In 4.1 and 4.0, you would use maxTotalDataSizeMB, at least indirectly.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

maxColdDBCount never did anything from 4.0 on. It does not and never did (even under version 3.x) delete or remove buckets from the cold store. It was used purely for search and memory resource management internally in 3.x, and had no effect in 4.x and up.

To manage space used on the cold store, in 4.2.x, you can (and should) use the volume limit settings. In 4.1 and 4.0, you would use maxTotalDataSizeMB, at least indirectly.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...