Deployment Architecture

Roll warm to cold based on time


I'm trying to configure my indexes.conf to roll all db files based on time. Hot -> Warm (1 day) -> Cold (2 weeks) -> Frozen (6 months). 

Now I know how to do the cold to frozen and frozen to thawed but I'm trying to figure out if I can do Hot to Warm to Cold based on time and not size.

I found references to a work around with the following set up

maxHotBuckets = 3
maxHotSpanSecs = 86400 (1day)
maxHotIdleSecs = 86400
maxWarmDBCount = 14
frozenTimePeriodinSecs = 15724800 (6 months)
coldToFrozenDir = <path>
thawedPath = <path>

Will this work to roll buckets from hot to warm in 24 hours, then from warm to cold in 2 weeks? Does anyone see an issue with this?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...