Deployment Architecture

What will happen when I change an already existing index from auto_high_volume to auto

TamasDubicz
Engager

Hey Everybody,

We just started a SmartStore migration project and we were warned to not migrate indexes with buckets with auto_high_volume. 

So we would like to change the maxDataSize settings in case of several already existing index from auto_high_volume to auto in an IDX cluster.

What will be the impact of this change? 

Will it cause increased I/O or other resource usage right after the change, will it “cut” the already existing high_volume buckets into 750 MB pieces? Aka. Will it be applied retrospectively?

What will happen a hot bucket what is more than 750 MB at the time when I apply the change?

 

Thank you in advance,
Tamas

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The maxDataSize setting is not applied retroactively.  The indexer must be restarted to apply the setting so there will be no hot buckets around to be affected by the change (recall that hot buckets roll to warm when indexers restart).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The maxDataSize setting is not applied retroactively.  The indexer must be restarted to apply the setting so there will be no hot buckets around to be affected by the change (recall that hot buckets roll to warm when indexers restart).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...