Deployment Architecture

What will happen when I change an already existing index from auto_high_volume to auto

TamasDubicz
Engager

Hey Everybody,

We just started a SmartStore migration project and we were warned to not migrate indexes with buckets with auto_high_volume. 

So we would like to change the maxDataSize settings in case of several already existing index from auto_high_volume to auto in an IDX cluster.

What will be the impact of this change? 

Will it cause increased I/O or other resource usage right after the change, will it “cut” the already existing high_volume buckets into 750 MB pieces? Aka. Will it be applied retrospectively?

What will happen a hot bucket what is more than 750 MB at the time when I apply the change?

 

Thank you in advance,
Tamas

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The maxDataSize setting is not applied retroactively.  The indexer must be restarted to apply the setting so there will be no hot buckets around to be affected by the change (recall that hot buckets roll to warm when indexers restart).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The maxDataSize setting is not applied retroactively.  The indexer must be restarted to apply the setting so there will be no hot buckets around to be affected by the change (recall that hot buckets roll to warm when indexers restart).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...