Deployment Architecture

Why can't I set maxHotBuckets > 10 ?

the_wolverine
Champion

We have an index that receives a lot of events resulting in buckets with 2 hour spans. I initially figured I would give this index 20 hot buckets by setting maxHotBuckets = 20 in indexes.conf.

After seeing the following message in splunkd.log, I think this actually caused issues on my indexer:

04-06-2011 21:13:13.505 INFO  HotDBManager - flushing db: $SPLUNK_DB/defaultdb/db/hot_v1_XXXX (max=10, count=11 )

When I set the value back to 10 hot buckets, the INFO message went away. Is this intentional to not allow > 10 hot buckets? And what is the reasoning?

1 Solution

the_wolverine
Champion

There hasn't been a response to this question. If you encounter the same issue I suggest filing a support ticket.

View solution in original post

0 Karma

the_wolverine
Champion

There hasn't been a response to this question. If you encounter the same issue I suggest filing a support ticket.

0 Karma

the_wolverine
Champion

Could someone look into this and let me know whether this is a bug? However, based on Vishal's response, it appears that the behavior I'm seeing is unintended (= Bug).

0 Karma

Vishal_Patel
Splunk Employee
Splunk Employee

wolverine, that message is not an ERROR, it is simply an INFO message stating that we are going to roll this bucket since it has exceeded maxHotBuckets count.

Please do the following to diagnose why it isn't set to 20:

% splunk cmd btool indexes list main

and verify that the maxHotBuckets is indeed set to 20, if not, you have a conf loading issue

0 Karma

the_wolverine
Champion

Still waiting for a response 5.5 months later.

0 Karma

the_wolverine
Champion

I have verified that the update to indexes.conf is being loaded correctly per the command you provided, Vishal.

0 Karma

the_wolverine
Champion

Pardon my nomenclature! I've updated my post to reflect this. What do I do once I confirm that this is a conf loading issue? Note that the INFO message went away after I changed my maxHotBuckets count to 10.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...