Dashboards & Visualizations

index.conf file query

isha_ish
Engager

what does the below DataSize MB means on the index.conf file. just wanted to know how it works

 

homePath = volume:hot1/fxmp_core_prod/db
coldPath = volume:cold1/fxmp_core_prod/colddb
thawedPath = $SPLUNK_DB/fxmp_core_prod/thaweddb
homePath.maxDataSizeMB = 2048 --> what does this implies
maxTotalDataSizeMB = 5120 --> what does this implies

Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust
homePath.maxDataSizeMB = <nonnegative integer>
* Specifies the maximum size of 'homePath' (which contains hot and warm
  buckets).
* If this size is exceeded, splunkd moves buckets with the oldest value
  of latest time (for a given bucket) into the cold DB until homePath is
  below the maximum size.
* If you set this setting to 0, or do not set it, splunkd does not constrain the
  size of 'homePath'.
* The highest legal value is 4294967295.
* Splunkd ignores this setting for remote storage enabled indexes.
* Default: 0

 

maxTotalDataSizeMB = <nonnegative integer>
* The maximum size of an index, in megabytes.
* If an index grows larger than the maximum size, splunkd freezes the oldest
  data in the index.
* This setting only applies to hot, warm, and cold buckets. It does
  not apply to thawed buckets.
* CAUTION: This setting takes precedence over other settings like
  'frozenTimePeriodInSecs' with regard to data retention. If the index
  grows beyond 'maxTotalDataSizeMB' megabytes before
  'frozenTimePeriodInSecs' seconds have passed, data could prematurely
  roll to frozen. As the default policy for rolling data to frozen is
  deletion, unintended data loss could occur.
* Splunkd ignores this setting on remote storage enabled indexes.
* Highest legal value is 4294967295
* Default: 500000


 

https://docs.splunk.com/Documentation/Splunk/8.0.6/Admin/Indexesconf

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

homePath.maxDataSizeMB specifies how much disk space the hot and warm buckets can use.  Once this limit is reached buckets are rolled to cold.

maxTotalDataSizeMB specifies how much disk space the hot, warm, and cold buckets can use.  Once this limit is reached buckets are frozen.

See $SPLUNK_HOME/etc/system/README/indexes.conf.spec

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...