Archive
Highlighted

Reducing maxWarmDBCount below current warm bucket count.

Explorer

Hi,

To utilise some additional space that I have brought online, I have configured the colddb path to use new storage and new warm-to-cold migrations are using the new storage.

Currently the maxWarmDBCount is set to the default (300) in the $SPLUNK_HOME/etc/system/default/indexes.conf, if I add a maxWarmDBCount setting to $SPLUNK_HOME/etc/system/local/indexes.conf at a value less than the number of warm buckets that currently exist, will splunk "do the right thing" and migrate the oldest warm buckets to the cold storage until it gets to the new maxWarmDBCount value?

Thanks again,

mgh

Tags (2)
Highlighted

Re: Reducing maxWarmDBCount below current warm bucket count.

SplunkTrust
SplunkTrust

Yes, once you restart splunkd and give it a little time to do so. It may not do it immediately upon restart, but it will notice there are currently more warm buckets than there are set to be, and it will roll the oldest ones to cold until it matches your policy.

View solution in original post

Highlighted

Re: Reducing maxWarmDBCount below current warm bucket count.

Explorer

As if by magic. Thanks again.

0 Karma