Deployment Architecture

What initiates the data rotation between buckets?

Path Finder

Hi all,

which of the following initiates data rotation between buckets.

Is it the time from which the event is indexed or is it the timestamp attached to the event?


Tags (2)
0 Karma


Hi James, neither of them if you talk about hot/warm buckets. Those are created and rotated solely based on the size and number of those already in these statuses.

  • Older hot buckets are rolled to warm when they are more than maxHotBuckets, each as big as maxDataSize specifies (plus some other idle data rules...).
  • Older warm buckets are rolled to cold when they are more than maxWarmDBCount.
  • Older cold buckets are rolled to frozen when their latest event timestamp is older than frozenTimePeriodInSecs.
  • Also, if the index grows more than maxTotalDataSizeMB, the oldest data is rolled to frozen.

Some more settings may be applied, please check the Index.conf docs for that.


0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!