Deployment Architecture

When will my buckets roll?

erw550
Path Finder

Hello,

We have a clustered environment which collects 2000gb+/day with indexes.conf settings below and the rest of the settings is default.
When does the frozenTimePeriodInSecs starts its count? Is it when the data is in the hot, warm or cold buckets?
When will the buckets roll from hot to warm, and from warm to frozen in my case? Is it after 90 days since MaxHotSpanSecs default is 90 days?
What is the approximate retention time for data with this config?
And the maxWarmDBCount = 4294967295 seems really high in this case. See config below:

[index_name]

homePath = volume:hot_warm/index_name/main/db

coldPath = volume:cold/index_name/main/colddb

thawedPath = /opt/splunk/indexes/index_name/main/thaweddb

maxWarmDBCount = 4294967295

frozenTimePeriodInSecs = 31104000

maxDataSize = auto_high_volume

maxTotalDataSizeMB = 4294967295

repFactor = auto

 

Thanks in advance!

Tags (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

In practically thinking you can count that it starts when hot bucket rolls to warm. It count the time from event's time not indexing time. Basically this means that this time can fulfil already when hot -> warm rolling has happened. But as all buckets has several event splunk will look the newest event (based on event creation time/_time) this is not that simple. Splunk must wait until all events has older than frozenTimePeriodInSecs before it get rid of that bucket. For that reason it's normal situation that there are some older events in splunk than you are expecting.

As you already notice there are also other parameters which define when the bucket actually will be frozen. Usually this means that lowest value of those will define that time.

There is something more:

You could also search more information from community.

r. Ismo

Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...