Deployment Architecture

differences between warm and cold buckets?

Contributor

In Splunk 4.3 (if it matters), besides it's location, is there any difference between a warm and a cold index bucket? Either in its structure or in how Splunk accesses/searches/processes them?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

Both warm and cold buckets are searchable; the differences are location and age. You configure the thresholds in indexes.conf. See How Splunk stores indexes and Back up indexed data in the documentation for more information.

View solution in original post

Splunk Employee
Splunk Employee

Both warm and cold buckets are searchable; the differences are location and age. You configure the thresholds in indexes.conf. See How Splunk stores indexes and Back up indexed data in the documentation for more information.

View solution in original post

Contributor

Accepting this answer, since it more or less answered what I asked. Though, technically the only real difference seems to be location. Splunk rolls warm-to-cold based on age, but there's nothing in the structure of the buckets that would prevent manually moving one to the other, for instance. The real benefit of warm-to-cold would be in the ability to use less-expensive / slower storage for cold buckets which, in theory, would need to be accessed less often.