Environment is single-site with 3 indexers and each indexer with parallelIngestionPipelines = 1(under /opt/splunk/etc/system/default/server.conf).
Does above imply that I have TOTAL "three" ingestion pipelines into my environment (one from each indexer) ?
If yes, with the setting of "maxHotBuckets=10" , would that mean I will have total limit of 30 hot buckets, considering 10 belonging to each ingestion pipeline ?
Yes on the pipelines, yes but per index on the hot buckets.
| dbinspect can show you how many buckets there are, and what state they are in.
Thanks Martin, I got your point.
Now, since I enabled maxHotBuckets to 10 for only one index out of 5 indexes.
Is it possible I can separate and validate Hot buckets count for this one index ? could you help me with some effective query here -