Getting Data In

Indexes Config: Relationship of maxTotalDataSizeMB to home and cold


What is the industry practice for setting the home and cold sizes? If home + cold = maxTotalDataSizeMB, should we

home - 50%
cold - 50%

home - 30%
cold - 70%

home - 10%
cold - 90%

d.) others

Hoping to get enlightenment from the crowd. Thanks a lot!

0 Karma


This is a very helpful tool:

0 Karma

Super Champion

Hi @morethanyell

If you have a look here :

You will notice that warm and cold buckets are both the same. The only difference is where they are stored. This allows you to create storage tiering with different disk performance based on how old data is. This means you can have fast disks (possibly SSD) -> fast search results for warm data in the home path and slower disks -> slower search results for older data in the cold path.

Most users typically run searches over the last week, machine data older than that are rarely used for real time analytics. It's therefore recommended to keep at least a weeks data in home storage and the rest can go to cold storage. If you think your users will be expecting more than one week of "fast data" then adapt your home storage accordingly.

Let me know if you need more details.



Use it when there is a restriction on the hard disk, and you want to set the data to be searched quickly to the fast disk, and to set the data to not search much to the network drive. I do not have to worry if it is on the same disc. auto, auto_high_volume is good.

It is a reference link.


Thank you. So, basically, there's no industry standard.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...