Splunk Primary data not auto rolled to secondary after configuration change

[elend]

I wanna ask something on my lab clustered indexer. I got max primary capacity on my indexer. Last time i just reduce the maxWarmDBCount based on the existing db created, and after 1-2 day, it rolled to secondary storage. But this time i apply this modification again but it not rolled until one week. I also already crosscheck on the DB created on the index created and it still above the limit i set, i also check if the config already distributed. Anyone faced this scenario? 

#splunk

[elend · Accepted solution]

actually additional step is just to rolling restart after the config changes. and it will rebalanced

[livehybrid]

Hi @elend 

The issue is likely that reducing maxWarmDBCount alone doesn't force immediate bucket rolling. Splunk only moves buckets from warm to cold during natural bucket transitions, not retroactively for existing buckets that exceed the new limit.

Theres also some good info at https://docs.splunk.com/Documentation/Splunk/latest/Indexer/HowSplunkstoresindexes#How_buckets_roll_... which might help describe your situation, and also https://splunk.my.site.com/customer/s/article/HOW-TO-Reduce-the-Amount-of-Hot-and-Warm-Buckets 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[elend]

yes sure. also based on this HOW TO: Reduce the Amount of Hot and Warm Buckets. | Splunk, i already meet with the condition. and the changes will trigger the bucket change whenever one of the following is reached. And on my condition one of the trigger already reached, but the data(DB) still not moved.

[kiran_panchavat]

@elend check this https://community.splunk.com/t5/Getting-Data-In/Reducing-maxWarmDBCount-below-current-warm-bucket-co... 

[elend]

yeah, im not set it up on default folder. so it should be same with that condition. Additionaly, this is distributed indexer (3 instance).

[kiran_panchavat]

@elend 

Refer this screenshot. 

[kiran_panchavat]

@elend 

Splunk bucket transitions from Hot → Warm → Cold → Frozen are controlled by multiple parameters:

maxHotBuckets, maxDataSize or homePath.maxDataSizeMB, maxHotSpanSecs maxWarmDBCount

Simply reducing maxWarmDBCount may not trigger a bucket roll if other thresholds, such as time or size haven’t been met. For instance, warm buckets will remain as-is if they haven't exceeded the defined size or time limits.

[elend]

Additionaly, i also check and reduce the maxsize too for sampling one index. So I change the value from homePath.maxDataSizeMB, maxWarmDBCount. I did it last week, but when i check the total db or the size from the index data, there is still no data moved.