Getting Data In
Highlighted

How does Splunk rotate indexed data (colddb, etc)?

Path Finder

Hi,

I have an index called app1 with the following configuration.

[app1]
coldPath = $SPLUNKDB/app1/colddb
homePath = $SPLUNK
DB/app1/db
thawedPath = $SPLUNKDB/app1/thaweddb
maxDataSize = auto
high_volume
frozenTimePeriodInSecs = 31536000
maxTotalDataSizeMB = 5000000
repFactor = auto

Under $SPLUNK_DB/app1/, here is the output of " du -sk * "

2016530744 colddb
0 datamodel_summary
2256897696 db
0 thaweddb

My understanding is that data is indexed and stored for 365 days, and I would assume the indexed data is stored under $SPLUNK_DB/app1/db. The part I don't understand is how the data is rolled into colddb and where may that be configured.

Any help will be greatly appreciated.

Thanks.

0 Karma
Highlighted

Re: How does Splunk rotate indexed data (colddb, etc)?

Splunk Employee
Splunk Employee

Hey @jackiewkc, Here's a link to an overview: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Bucketsandclusters
Buckets can be configured for max size or time and they rotate when the last event to enter the bucket matches the criteria. Hot/warm are stored in a different location than cold, which helps w/ search efficiency. (Splunk skips buckets if it can tell from the outside that the time range won't match, which is part of why time is such an efficient search parameter). For it to roll into colddb the conditions are configurable (for all stages, that is). You can read more about those configurations here: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Configureindexstorage