Deployment Architecture

Why can't I set maxHotBuckets > 10 ?

the_wolverine
Champion

We have an index that receives a lot of events resulting in buckets with 2 hour spans. I initially figured I would give this index 20 hot buckets by setting maxHotBuckets = 20 in indexes.conf.

After seeing the following message in splunkd.log, I think this actually caused issues on my indexer:

04-06-2011 21:13:13.505 INFO  HotDBManager - flushing db: $SPLUNK_DB/defaultdb/db/hot_v1_XXXX (max=10, count=11 )

When I set the value back to 10 hot buckets, the INFO message went away. Is this intentional to not allow > 10 hot buckets? And what is the reasoning?

1 Solution

the_wolverine
Champion

There hasn't been a response to this question. If you encounter the same issue I suggest filing a support ticket.

View solution in original post

0 Karma

the_wolverine
Champion

There hasn't been a response to this question. If you encounter the same issue I suggest filing a support ticket.

0 Karma

the_wolverine
Champion

Could someone look into this and let me know whether this is a bug? However, based on Vishal's response, it appears that the behavior I'm seeing is unintended (= Bug).

0 Karma

Vishal_Patel
Splunk Employee
Splunk Employee

wolverine, that message is not an ERROR, it is simply an INFO message stating that we are going to roll this bucket since it has exceeded maxHotBuckets count.

Please do the following to diagnose why it isn't set to 20:

% splunk cmd btool indexes list main

and verify that the maxHotBuckets is indeed set to 20, if not, you have a conf loading issue

0 Karma

the_wolverine
Champion

Still waiting for a response 5.5 months later.

0 Karma

the_wolverine
Champion

I have verified that the update to indexes.conf is being loaded correctly per the command you provided, Vishal.

0 Karma

the_wolverine
Champion

Pardon my nomenclature! I've updated my post to reflect this. What do I do once I confirm that this is a conf loading issue? Note that the INFO message went away after I changed my maxHotBuckets count to 10.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...