Deployment Architecture

Roll warm to cold based on time

michaeler
Communicator

I'm trying to configure my indexes.conf to roll all db files based on time. Hot -> Warm (1 day) -> Cold (2 weeks) -> Frozen (6 months). 

Now I know how to do the cold to frozen and frozen to thawed but I'm trying to figure out if I can do Hot to Warm to Cold based on time and not size.

I found references to a work around with the following set up

[main]
maxHotBuckets = 3
maxHotSpanSecs = 86400 (1day)
maxHotIdleSecs = 86400
maxWarmDBCount = 14
frozenTimePeriodinSecs = 15724800 (6 months)
coldToFrozenDir = <path>
thawedPath = <path>

Will this work to roll buckets from hot to warm in 24 hours, then from warm to cold in 2 weeks? Does anyone see an issue with this?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...