Help in Configuring Indexes.conf

[pe_morris_ter]

Hello Guys,

I am trying to configure the indexes.conf, Here is the scenario, I need to have hot bucket for 6 months, warm & cold to another 6 months, after one year the data must follow to frozen bucket. I have defined following settings. Does it comes under Splunk best practices, Below is my index setting

[volume:A]
maxVolumeDataSizeMB = 1000000

[test_index]
homePath = volume:A/test_index/db
coldPath = volume:A/test_index/colddb
thawedPath = $SPLUNK_DB/test_index/thawedd
maxHotBuckets = 10
maxDataSize = 15000
maxHotSpanSecs = 15760000
coldToFrozenDir = /path/
maxTotalDataSizeMB = 1000000
frozenTimePeriodInSecs = 31104000

[vishaltaneja070]

Hi,

Above mentioned indexes.conf file looks fine. But in maxDataSize stanza you need to mention, the max data size is for which path, homepath(i.e. Hot and Warm) or coldpath(i.e. Cold )

Like homepath.maxDataSize=15000

Remaining things looks cool.

Thanks.