Deployment Architecture

Why can't I set maxHotBuckets > 10 ?

Champion

We have an index that receives a lot of events resulting in buckets with 2 hour spans. I initially figured I would give this index 20 hot buckets by setting maxHotBuckets = 20 in indexes.conf.

After seeing the following message in splunkd.log, I think this actually caused issues on my indexer:

04-06-2011 21:13:13.505 INFO  HotDBManager - flushing db: $SPLUNK_DB/defaultdb/db/hot_v1_XXXX (max=10, count=11 )

When I set the value back to 10 hot buckets, the INFO message went away. Is this intentional to not allow > 10 hot buckets? And what is the reasoning?

1 Solution

Champion

There hasn't been a response to this question. If you encounter the same issue I suggest filing a support ticket.

View solution in original post

0 Karma

Champion

There hasn't been a response to this question. If you encounter the same issue I suggest filing a support ticket.

View solution in original post

0 Karma

Champion

Could someone look into this and let me know whether this is a bug? However, based on Vishal's response, it appears that the behavior I'm seeing is unintended (= Bug).

0 Karma

Splunk Employee
Splunk Employee

wolverine, that message is not an ERROR, it is simply an INFO message stating that we are going to roll this bucket since it has exceeded maxHotBuckets count.

Please do the following to diagnose why it isn't set to 20:

% splunk cmd btool indexes list main

and verify that the maxHotBuckets is indeed set to 20, if not, you have a conf loading issue

0 Karma

Champion

Still waiting for a response 5.5 months later.

0 Karma

Champion

I have verified that the update to indexes.conf is being loaded correctly per the command you provided, Vishal.

0 Karma

Champion

Pardon my nomenclature! I've updated my post to reflect this. What do I do once I confirm that this is a conf loading issue? Note that the INFO message went away after I changed my maxHotBuckets count to 10.

0 Karma