Getting Data In

Reducing maxWarmDBCount below current warm bucket count.

mgherman
Explorer

Hi,

To utilise some additional space that I have brought online, I have configured the colddb path to use new storage and new warm-to-cold migrations are using the new storage.

Currently the maxWarmDBCount is set to the default (300) in the $SPLUNK_HOME/etc/system/default/indexes.conf, if I add a maxWarmDBCount setting to $SPLUNK_HOME/etc/system/local/indexes.conf at a value less than the number of warm buckets that currently exist, will splunk "do the right thing" and migrate the oldest warm buckets to the cold storage until it gets to the new maxWarmDBCount value?

Thanks again,

mgh

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Yes, once you restart splunkd and give it a little time to do so. It may not do it immediately upon restart, but it will notice there are currently more warm buckets than there are set to be, and it will roll the oldest ones to cold until it matches your policy.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Yes, once you restart splunkd and give it a little time to do so. It may not do it immediately upon restart, but it will notice there are currently more warm buckets than there are set to be, and it will roll the oldest ones to cold until it matches your policy.

View solution in original post

mgherman
Explorer

As if by magic. Thanks again.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!