Getting Data In

Help in Configuring Indexes.conf

New Member

Hello Guys,

I am trying to configure the indexes.conf, Here is the scenario, I need to have hot bucket for 6 months, warm & cold to another 6 months, after one year the data must follow to frozen bucket. I have defined following settings. Does it comes under Splunk best practices, Below is my index setting

maxVolumeDataSizeMB = 1000000

homePath = volume:A/test_index/db
coldPath = volume:A/test_index/colddb
thawedPath = $SPLUNK_DB/test_index/thawedd
maxHotBuckets = 10
maxDataSize = 15000
maxHotSpanSecs = 15760000
coldToFrozenDir = /path/
maxTotalDataSizeMB = 1000000
frozenTimePeriodInSecs = 31104000

0 Karma



Above mentioned indexes.conf file looks fine. But in maxDataSize stanza you need to mention, the max data size is for which path, homepath(i.e. Hot and Warm) or coldpath(i.e. Cold )

Like homepath.maxDataSize=15000

Remaining things looks cool.


0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!