index keeps rolling of data due to size

[Markfill]

index keeps rolling of data due to size even after size has been increased. Is there another way to resolve this issue?

[PickleRick]

When you keep hitting the size limit, Splunk will roll the buckets to frozen. That's the point.

Some things worth verifying:

1) How did you increase the size limit? Which parameters did you edit and did you restart your splunkd?

2) How do you know buckets are frozen due to size limit?

3) Do you have volume size limits?

[Markfill]

Here's my configuration

[mack]
repFactor=auto
coldPath = volume:cold/customer/mack/colddb
homePath = volume:hot_warm/customer/mack/db
thawedPath = /splunk/data/cold/customer/mack/thaweddb
frozenTimePeriodInSecs = 34186680
maxHotBuckets = 10
maxTotalDataSizeMB = 400000

so instead of data rolling to cold, it rolls off

[PickleRick]

1. OK. This is _current_ configuration. It would be even better to see the output of

splunk btool indexes list mack

and

| rest /services/data/indexes/mack

But the question is what/how did you change.

2. Did you check the reason for bucket rolling?

index=_internal component=BucketMover idx=mack

[Markfill]

Thanks @PickleRick  your last reply showed me what i was looking for. Data now rolls of after it get's to cold. Not able to search when it gets to cold.

[Markfill]

Yes.... It's showing maximum warm bucket exceeded. Firing async chiller

[PickleRick]

Check also the _internal events from component=DatabaseDirectoryManager around that time (not all events have idx= field).

There might be different factors at play, like retention period. You could check your buckets with dbinspect and see earliest/latest events in them.

Anyway, 10 hot buckets is quite a lot.

[VatsalJagani]

@Markfill - Please describe what do you mean by index rolling (I assume, you mean bucket rolling and not index rolling.)

* Warm Bucket to Cold Bucket?

OR 

* Cold Bucket to Frozen Bucket or being deleted?