Reducing maxWarmDBCount below current warm bucket count.

[mgherman]

Hi,

To utilise some additional space that I have brought online, I have configured the colddb path to use new storage and new warm-to-cold migrations are using the new storage.

Currently the maxWarmDBCount is set to the default (300) in the $SPLUNK_HOME/etc/system/default/indexes.conf, if I add a maxWarmDBCount setting to $SPLUNK_HOME/etc/system/local/indexes.conf at a value less than the number of warm buckets that currently exist, will splunk "do the right thing" and migrate the oldest warm buckets to the cold storage until it gets to the new maxWarmDBCount value?

Thanks again,

mgh

[dwaddle · Accepted solution]

Yes, once you restart splunkd and give it a little time to do so. It may not do it immediately upon restart, but it will notice there are currently more warm buckets than there are set to be, and it will roll the oldest ones to cold until it matches your policy.

[mgherman]

As if by magic. Thanks again.