Deployment Architecture
Highlighted

How much time a bucket can be rolled?

Path Finder

Hello,

I want to know that is all the buckets are rolled every time we restart the indexer and is it safe.?
Is there any specific time a bucket can be rolled.?
will the restart of indexer will effect the buckets/indexes/searches?

0 Karma
Highlighted

Re: How much time a bucket can be rolled?

Legend

Hi ayushchoudhary,
buckets are rolled when time is the one you configured (or by default) or bucket dimension is the one you configured (or by default), rolling action isn't specificately related to Splunk restart, it's related to time and dimension configured.
Remeber that a bucket is rolled (or deleted after retention time) when the newest event exeed the configured time or the max configured dimension.

The rolling process is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes, instead rolling configuration is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Indexesconf.

Indexer restart will effect the buckets/indexes/searches if you modified some configuration (e.g. change index retention), otherwise buckets roling is subject to splunk configuration (time & dimentions).
Bye.
Giuseppe

View solution in original post

0 Karma
Highlighted

Re: How much time a bucket can be rolled?

Splunk Employee
Splunk Employee

@cusello,
Just to add 1 correction: Hot buckets DO get rolled to warm upon SplunkD restart. ( http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes#How_data_ages )

Also, please put a space after your first link (before the comma) so that the link gets you to the right place.

Otherwise, you're correct. 🙂

0 Karma