We have an index that receives a lot of events resulting in buckets with 2 hour spans. I initially figured I would give this index 20 hot buckets by setting maxHotBuckets = 20 in indexes.conf.
After seeing the following message in splunkd.log, I think this actually caused issues on my indexer:
04-06-2011 21:13:13.505 INFO HotDBManager - flushing db: $SPLUNK_DB/defaultdb/db/hot_v1_XXXX (max=10, count=11 )
When I set the value back to 10 hot buckets, the INFO message went away. Is this intentional to not allow > 10 hot buckets? And what is the reasoning?
wolverine, that message is not an ERROR, it is simply an INFO message stating that we are going to roll this bucket since it has exceeded maxHotBuckets count.
Please do the following to diagnose why it isn't set to 20:
% splunk cmd btool indexes list main
and verify that the maxHotBuckets is indeed set to 20, if not, you have a conf loading issue
Pardon my nomenclature! I've updated my post to reflect this. What do I do once I confirm that this is a conf loading issue? Note that the INFO message went away after I changed my maxHotBuckets count to 10.
Could someone look into this and let me know whether this is a bug? However, based on Vishal's response, it appears that the behavior I'm seeing is unintended (= Bug).
There hasn't been a response to this question. If you encounter the same issue I suggest filing a support ticket.