Can anyone teach or show me some way to config data age of Hot Warm Cold with each indexs ? And how to check it successful?
Thanks for reading !
Hi nnips,
at https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Indexesconf you can find all the parameters to configure your indexes.
The way to check them is viewing indexes.conf file or (better) using Splunk Monitor Console.
Anyway, if you don't have special requirements, I usually set only global retention ( frozenTimePeriodInSecs
).
Bye.
Giuseppe
Hi nnips,
at https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Indexesconf you can find all the parameters to configure your indexes.
The way to check them is viewing indexes.conf file or (better) using Splunk Monitor Console.
Anyway, if you don't have special requirements, I usually set only global retention ( frozenTimePeriodInSecs
).
Bye.
Giuseppe
thanks you, i've one more question is hot warm data is automatic convert ?
Yes,
hot buckets are automatically rolled to warm and after to cold following the default or configured rules.
Bye.
Giuseppe
hi i'm just config in file indexes.conf of splunk have
maxWarmDBCount = 300
and 300 it ? (minutes or hours or days)
maxWarmDBCount it's The maximum number of warm buckets (see https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Indexesconf )
to configure retention you have to use frozenTimePeriodInSecs
that is expressed in seconds.
Bye.
Giuseppe