Deployment Architecture

How much time a bucket can be rolled?

ayushchoudhary
Path Finder

Hello,

I want to know that is all the buckets are rolled every time we restart the indexer and is it safe.?
Is there any specific time a bucket can be rolled.?
will the restart of indexer will effect the buckets/indexes/searches?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi ayushchoudhary,
buckets are rolled when time is the one you configured (or by default) or bucket dimension is the one you configured (or by default), rolling action isn't specificately related to Splunk restart, it's related to time and dimension configured.
Remeber that a bucket is rolled (or deleted after retention time) when the newest event exeed the configured time or the max configured dimension.

The rolling process is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes, instead rolling configuration is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Indexesconf.

Indexer restart will effect the buckets/indexes/searches if you modified some configuration (e.g. change index retention), otherwise buckets roling is subject to splunk configuration (time & dimentions).
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ayushchoudhary,
buckets are rolled when time is the one you configured (or by default) or bucket dimension is the one you configured (or by default), rolling action isn't specificately related to Splunk restart, it's related to time and dimension configured.
Remeber that a bucket is rolled (or deleted after retention time) when the newest event exeed the configured time or the max configured dimension.

The rolling process is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes, instead rolling configuration is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Indexesconf.

Indexer restart will effect the buckets/indexes/searches if you modified some configuration (e.g. change index retention), otherwise buckets roling is subject to splunk configuration (time & dimentions).
Bye.
Giuseppe

View solution in original post

0 Karma

brreeves_splunk
Splunk Employee
Splunk Employee

@cusello,
Just to add 1 correction: Hot buckets DO get rolled to warm upon SplunkD restart. ( http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes#How_data_ages )

Also, please put a space after your first link (before the comma) so that the link gets you to the right place.

Otherwise, you're correct. 🙂

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!