Deployment Architecture

Has maxColdDBCount been deprecated?

dah2016
Engager

So it appears that maxColdDBCount has been deprecated in 4.2.3. Is there replacement? Or should I just get rid off it? I was using it up to 4.1.7, just upgraded from that version.

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

maxColdDBCount never did anything from 4.0 on. It does not and never did (even under version 3.x) delete or remove buckets from the cold store. It was used purely for search and memory resource management internally in 3.x, and had no effect in 4.x and up.

To manage space used on the cold store, in 4.2.x, you can (and should) use the volume limit settings. In 4.1 and 4.0, you would use maxTotalDataSizeMB, at least indirectly.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

maxColdDBCount never did anything from 4.0 on. It does not and never did (even under version 3.x) delete or remove buckets from the cold store. It was used purely for search and memory resource management internally in 3.x, and had no effect in 4.x and up.

To manage space used on the cold store, in 4.2.x, you can (and should) use the volume limit settings. In 4.1 and 4.0, you would use maxTotalDataSizeMB, at least indirectly.

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...