I have recently upgraded my indexer to have two sets of drives. SSDs are mounted on /fast
and spinning rust is sitting on /cold
. I have configured the indexes to have homePath
on the /fast
partition and coldPath
on the /cold
partition.
Because this is a new setup, there is a lot of data in the cold indexes already. I'd like to un-roll the indexes so everything is on the /fast
partition and only roll over when it fills up.
Here are the steps:
maxWarmDBCount = 10000
or a number large enough to fill your /fast partition. Also, you should be using volumes to manage the size of the home directory (hot + warm) to avoid completely filling the disk. Splunk will roll the warm buckets to cold (again) when it either hits the maxWarmDBCount or the volume size for hot/warm.
Here are the steps:
maxWarmDBCount = 10000
or a number large enough to fill your /fast partition. Also, you should be using volumes to manage the size of the home directory (hot + warm) to avoid completely filling the disk. Splunk will roll the warm buckets to cold (again) when it either hits the maxWarmDBCount or the volume size for hot/warm.
So the deletion of .bucketmanifest is not required anymore? ie. manifests are now checked against existing files upon start up "every time"? I hadn't checked if this was still required in any v6 version.