Getting Data In

Help in Configuring Indexes.conf

New Member

Hello Guys,

I am trying to configure the indexes.conf, Here is the scenario, I need to have hot bucket for 6 months, warm & cold to another 6 months, after one year the data must follow to frozen bucket. I have defined following settings. Does it comes under Splunk best practices, Below is my index setting

[volume:A]
maxVolumeDataSizeMB = 1000000

[test_index]
homePath = volume:A/test_index/db
coldPath = volume:A/test_index/colddb
thawedPath = $SPLUNK_DB/test_index/thawedd
maxHotBuckets = 10
maxDataSize = 15000
maxHotSpanSecs = 15760000
coldToFrozenDir = /path/
maxTotalDataSizeMB = 1000000
frozenTimePeriodInSecs = 31104000

0 Karma

Motivator

Hi,

Above mentioned indexes.conf file looks fine. But in maxDataSize stanza you need to mention, the max data size is for which path, homepath(i.e. Hot and Warm) or coldpath(i.e. Cold )

Like homepath.maxDataSize=15000

Remaining things looks cool.

Thanks.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!