Dashboards & Visualizations

index.conf file query

isha_ish
Engager

what does the below DataSize MB means on the index.conf file. just wanted to know how it works

 

homePath = volume:hot1/fxmp_core_prod/db
coldPath = volume:cold1/fxmp_core_prod/colddb
thawedPath = $SPLUNK_DB/fxmp_core_prod/thaweddb
homePath.maxDataSizeMB = 2048 --> what does this implies
maxTotalDataSizeMB = 5120 --> what does this implies

Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust
homePath.maxDataSizeMB = <nonnegative integer>
* Specifies the maximum size of 'homePath' (which contains hot and warm
  buckets).
* If this size is exceeded, splunkd moves buckets with the oldest value
  of latest time (for a given bucket) into the cold DB until homePath is
  below the maximum size.
* If you set this setting to 0, or do not set it, splunkd does not constrain the
  size of 'homePath'.
* The highest legal value is 4294967295.
* Splunkd ignores this setting for remote storage enabled indexes.
* Default: 0

 

maxTotalDataSizeMB = <nonnegative integer>
* The maximum size of an index, in megabytes.
* If an index grows larger than the maximum size, splunkd freezes the oldest
  data in the index.
* This setting only applies to hot, warm, and cold buckets. It does
  not apply to thawed buckets.
* CAUTION: This setting takes precedence over other settings like
  'frozenTimePeriodInSecs' with regard to data retention. If the index
  grows beyond 'maxTotalDataSizeMB' megabytes before
  'frozenTimePeriodInSecs' seconds have passed, data could prematurely
  roll to frozen. As the default policy for rolling data to frozen is
  deletion, unintended data loss could occur.
* Splunkd ignores this setting on remote storage enabled indexes.
* Highest legal value is 4294967295
* Default: 500000


 

https://docs.splunk.com/Documentation/Splunk/8.0.6/Admin/Indexesconf

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

homePath.maxDataSizeMB specifies how much disk space the hot and warm buckets can use.  Once this limit is reached buckets are rolled to cold.

maxTotalDataSizeMB specifies how much disk space the hot, warm, and cold buckets can use.  Once this limit is reached buckets are frozen.

See $SPLUNK_HOME/etc/system/README/indexes.conf.spec

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...