hi @gcusello Firstly, it doesn't matter at all whether you passed or failed, you were and will remain one of the most knowledgeable forum members, the kind of guy who makes others NOT to attempt answers for the questions that you have already answered, for they are always correct!
The question is tricky , I did try to make some sense of it from my local. I may (most probably will be) wrong.
As you say there is a max size of the entire index(and all indexes) in general that can go up to 500 GB. That is more like an upper limit perhaps?
Below that is given max size of hot/warm/cold bucket ~ 1 GB each. Now, if the buckets were created with the deafult max size of 1 gb each and assuming we include 5 buckets hot,warm,cold,frozen and thawed it would perhaps be 5 gb in total.
There is a separate path for thawed db and an optional path for frozen as well in the same settings screen shot.
If you refer this - https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/HowSplunkstoresindexes#Bucket_names
and see the section 'how data ages'
A bucket moves through several states as it ages:
hot
warm
cold
frozen
thawed
As buckets age, they "roll" from one state to the next. When data is first indexed, it gets written to a hot bucket. Hot buckets are buckets that actively being written to. An index can have several hot buckets open at a time. Hot buckets are also searchable.
When certain conditions are met (for example, the hot bucket reaches a certain size or the indexer gets restarted), the hot bucket becomes a warm bucket ("rolls to warm"), and a new hot bucket is created in its place. The warm bucket is renamed but it remains in the same location as when it was a hot bucket. Warm buckets are searchable, but they are not actively written to. There can be a large number of warm buckets.
Once further conditions are met (for example, the index reaches some maximum number of warm buckets), the indexer begins to roll the warm buckets to cold, based on their age. It always selects the oldest warm bucket to roll to cold. Buckets continue to roll to cold as they age in this manner. Cold buckets reside in a different location from hot and warm buckets. You can configure the location so that cold buckets reside on cheaper storage.
Finally, after certain other time-based or size-based conditions are met, cold buckets roll to the frozen state, at which point they are deleted from the index, after being optionally archived.
If the frozen data has been archived, it can later be thawed. Data in thawed buckets is available for searches.
Settings in indexes.conf determine when a bucket moves from one state to the next.
They talk about 5 buckets and assuming that they already come with some default size(the max size per bucket) it could be 5 gb . answer#1.
It does also say that frozen buckets are deleted by default unless they are archived so I am not all sure!
I am just perhaps trying to force fit an answer given the options that you mentioned...
or could it be a typo in the question from the exam itself!!?
Sorry, if you had already considered these options and decided that they were incorrect.
hi @gcusello Firstly, it doesn't matter at all whether you passed or failed, you were and will remain one of the most knowledgeable forum members, the kind of guy who makes others NOT to attempt answers for the questions that you have already answered, for they are always correct!
The question is tricky , I did try to make some sense of it from my local. I may (most probably will be) wrong.
As you say there is a max size of the entire index(and all indexes) in general that can go up to 500 GB. That is more like an upper limit perhaps?
Below that is given max size of hot/warm/cold bucket ~ 1 GB each. Now, if the buckets were created with the deafult max size of 1 gb each and assuming we include 5 buckets hot,warm,cold,frozen and thawed it would perhaps be 5 gb in total.
There is a separate path for thawed db and an optional path for frozen as well in the same settings screen shot.
If you refer this - https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/HowSplunkstoresindexes#Bucket_names
and see the section 'how data ages'
A bucket moves through several states as it ages:
hot
warm
cold
frozen
thawed
As buckets age, they "roll" from one state to the next. When data is first indexed, it gets written to a hot bucket. Hot buckets are buckets that actively being written to. An index can have several hot buckets open at a time. Hot buckets are also searchable.
When certain conditions are met (for example, the hot bucket reaches a certain size or the indexer gets restarted), the hot bucket becomes a warm bucket ("rolls to warm"), and a new hot bucket is created in its place. The warm bucket is renamed but it remains in the same location as when it was a hot bucket. Warm buckets are searchable, but they are not actively written to. There can be a large number of warm buckets.
Once further conditions are met (for example, the index reaches some maximum number of warm buckets), the indexer begins to roll the warm buckets to cold, based on their age. It always selects the oldest warm bucket to roll to cold. Buckets continue to roll to cold as they age in this manner. Cold buckets reside in a different location from hot and warm buckets. You can configure the location so that cold buckets reside on cheaper storage.
Finally, after certain other time-based or size-based conditions are met, cold buckets roll to the frozen state, at which point they are deleted from the index, after being optionally archived.
If the frozen data has been archived, it can later be thawed. Data in thawed buckets is available for searches.
Settings in indexes.conf determine when a bucket moves from one state to the next.
They talk about 5 buckets and assuming that they already come with some default size(the max size per bucket) it could be 5 gb . answer#1.
It does also say that frozen buckets are deleted by default unless they are archived so I am not all sure!
I am just perhaps trying to force fit an answer given the options that you mentioned...
or could it be a typo in the question from the exam itself!!?
Sorry, if you had already considered these options and decided that they were incorrect.
