Deployment Architecture

What initiates the data rotation between buckets?

jamesaarondevli
Path Finder

Hi all,

which of the following initiates data rotation between buckets.

Is it the time from which the event is indexed or is it the timestamp attached to the event?

Cheers,
James

Tags (2)
0 Karma

Paolo_Prigione
Builder

Hi James, neither of them if you talk about hot/warm buckets. Those are created and rotated solely based on the size and number of those already in these statuses.

  • Older hot buckets are rolled to warm when they are more than maxHotBuckets, each as big as maxDataSize specifies (plus some other idle data rules...).
  • Older warm buckets are rolled to cold when they are more than maxWarmDBCount.
  • Older cold buckets are rolled to frozen when their latest event timestamp is older than frozenTimePeriodInSecs.
  • Also, if the index grows more than maxTotalDataSizeMB, the oldest data is rolled to frozen.

Some more settings may be applied, please check the Index.conf docs for that.

Paolo

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>