Deployment Architecture

Can we list the hot buckets?

danielbb
Motivator

With all the discussions about smartstore here, there is some sort of treatment of the hot buckets mechanism as a cohesive layer. Can we maybe produce a report of the current hot buckets, their size and age?

Tags (2)
0 Karma

martynoconnor
Communicator

Try this:

| dbinspect where index=* state=hot
| fields startEpoch sizeOnDiskMB path index
| eval now=now(),ageInHours=round(((now-startEpoch)/3600),2),sizeOnDiskMB=round(sizeOnDiskMB,2)
| fields - now startEpoch
| table index path sizeOnDiskMB ageInHours

danielbb
Motivator

Using this query, I see huge discrepancies between the ageInHours for different indexes - how can we visualize it nicely?

BTW, the round function fails to do its job here for some reason.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Hot buckets are not part of SmartStore.

Use the |dbinspect command to for information about buckets, including hot buckets.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...