Deployment Architecture

index keeps rolling of data due to size

Markfill
Observer

index keeps rolling of data due to size even after size has been increased. Is there another way to resolve this issue?

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

When you keep hitting the size limit, Splunk will roll the buckets to frozen. That's the point.

Some things worth verifying:

1) How did you increase the size limit? Which parameters did you edit and did you restart your splunkd?

2) How do you know buckets are frozen due to size limit?

3) Do you have volume size limits?

0 Karma

Markfill
Observer

Here's my configuration

[mack]
repFactor=auto
coldPath = volume:cold/customer/mack/colddb
homePath = volume:hot_warm/customer/mack/db
thawedPath = /splunk/data/cold/customer/mack/thaweddb
frozenTimePeriodInSecs = 34186680
maxHotBuckets = 10
maxTotalDataSizeMB = 400000

so instead of data rolling to cold, it rolls off

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. OK. This is _current_ configuration. It would be even better to see the output of

splunk btool indexes list mack

and

| rest /services/data/indexes/mack

But the question is what/how did you change.

2. Did you check the reason for bucket rolling?

index=_internal component=BucketMover idx=mack

 

0 Karma

Markfill
Observer

Thanks @PickleRick  your last reply showed me what i was looking for. Data now rolls of after it get's to cold. Not able to search when it gets to cold.

0 Karma

Markfill
Observer

Yes.... It's showing maximum warm bucket exceeded. Firing async chiller

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Check also the _internal events from component=DatabaseDirectoryManager around that time (not all events have idx= field).

There might be different factors at play, like retention period. You could check your buckets with dbinspect and see earliest/latest events in them.

Anyway, 10 hot buckets is quite a lot.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Markfill - Please describe what do you mean by index rolling (I assume, you mean bucket rolling and not index rolling.)

* Warm Bucket to Cold Bucket?

OR 

* Cold Bucket to Frozen Bucket or being deleted?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...