Getting Data In

How does Splunk rotate indexed data (colddb, etc)?

jackiewkc
Path Finder

Hi,

I have an index called app1 with the following configuration.

[app1]
coldPath = $SPLUNK_DB/app1/colddb
homePath = $SPLUNK_DB/app1/db
thawedPath = $SPLUNK_DB/app1/thaweddb
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 31536000
maxTotalDataSizeMB = 5000000
repFactor = auto

Under $SPLUNK_DB/app1/, here is the output of " du -sk * "

2016530744 colddb
0 datamodel_summary
2256897696 db
0 thaweddb

My understanding is that data is indexed and stored for 365 days, and I would assume the indexed data is stored under $SPLUNK_DB/app1/db. The part I don't understand is how the data is rolled into colddb and where may that be configured.

Any help will be greatly appreciated.

Thanks.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @jackiewkc, Here's a link to an overview: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Bucketsandclusters
Buckets can be configured for max size or time and they rotate when the last event to enter the bucket matches the criteria. Hot/warm are stored in a different location than cold, which helps w/ search efficiency. (Splunk skips buckets if it can tell from the outside that the time range won't match, which is part of why time is such an efficient search parameter). For it to roll into colddb the conditions are configurable (for all stages, that is). You can read more about those configurations here: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Configureindexstorage

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...