maxHotSpanSecs

[hjwang]

Hi~splunkers

According to the spec in indexes.conf, it stats the maxHotSpanSecs is Upper bound of target max timespan of hot/warm buckets in seconds and defaults to 90 days, but i want to make sure if this means that the warm_bucket time span will be within this setting interval. Because i found some warm_bucket like db_lastest_earliest, its interval is more than 90 days.

thanks a lot.

[jbsplunk · Accepted solution]

Data isn't written to warm buckets, it is only written to a bucket when it is hot. So that setting should take effect when data is hot and then the data would be rolled to warm, cold, frozen, etc.

[lguinn2]

No, a single hot bucket is "rolled" to a single warm bucket (via a simple filesystem rename).

[hjwang]

Does this mean one warm bucket can contain many hot rolled bucket? Because when maxHotSpanSecs set to 90 days, the hot bucket time span should not be more than 90 days, and it should be rolled to warm bucket. so I doubt why the warm bucket time span is more than 90 days