Getting Data In

Config data Hot Warm Cold ?

nnips
Engager

Can anyone teach or show me some way to config data age of Hot Warm Cold with each indexs ? And how to check it successful?
Thanks for reading !

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi nnips,
at https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Indexesconf you can find all the parameters to configure your indexes.
The way to check them is viewing indexes.conf file or (better) using Splunk Monitor Console.
Anyway, if you don't have special requirements, I usually set only global retention ( frozenTimePeriodInSecs ).
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nnips,
at https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Indexesconf you can find all the parameters to configure your indexes.
The way to check them is viewing indexes.conf file or (better) using Splunk Monitor Console.
Anyway, if you don't have special requirements, I usually set only global retention ( frozenTimePeriodInSecs ).
Bye.
Giuseppe

0 Karma

nnips
Engager

thanks you, i've one more question is hot warm data is automatic convert ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Yes,
hot buckets are automatically rolled to warm and after to cold following the default or configured rules.
Bye.
Giuseppe

0 Karma

nnips
Engager

hi i'm just config in file indexes.conf of splunk have
maxWarmDBCount = 300

and 300 it ? (minutes or hours or days)

0 Karma

gcusello
SplunkTrust
SplunkTrust

maxWarmDBCount it's The maximum number of warm buckets (see https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Indexesconf )
to configure retention you have to use frozenTimePeriodInSecs that is expressed in seconds.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...