What factors into how Splunk creates new hot buckets?

[jitsinha]

Can anybody put some light on the factors based on why Splunk creates new Hot buckets??

Like maxDataSize and maxHotBuckets - these are the two factors responsible for rollover from hot to warm.

[MuS]

Hi jitsinha,

you can find everything in the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/HowSplunkstoresindexes :

Newly indexed data goes into a hot bucket, which is a bucket that's both searchable and actively being written to. After the hot bucket reaches a certain size, it becomes a warm bucket ("rolls to warm"), and a new hot bucket is created. 

and / or in the wiki :

• http://wiki.splunk.com/Deploy:UnderstandingBuckets
• http://wiki.splunk.com/Deploy:BucketRotationAndRetention

hope this helps ...

cheers, MuS

[anwarmian]

I gave an up point because MuS mentions that hot buckets are both searchable and actively being written to. This a good point. Warm buckets, on the other hand, are searchable but NOT actively written to. Splunk restart also rolls hot to warm.

[jitsinha]

anyone please??