Getting Data In

maxHotSpanSecs

hjwang
Contributor

Hi~splunkers

According to the spec in indexes.conf, it stats the maxHotSpanSecs is Upper bound of target max timespan of hot/warm buckets in seconds and defaults to 90 days, but i want to make sure if this means that the warm_bucket time span will be within this setting interval. Because i found some warm_bucket like db_lastest_earliest, its interval is more than 90 days.

thanks a lot.

Tags (1)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Data isn't written to warm buckets, it is only written to a bucket when it is hot. So that setting should take effect when data is hot and then the data would be rolled to warm, cold, frozen, etc.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

Data isn't written to warm buckets, it is only written to a bucket when it is hot. So that setting should take effect when data is hot and then the data would be rolled to warm, cold, frozen, etc.

lguinn2
Legend

No, a single hot bucket is "rolled" to a single warm bucket (via a simple filesystem rename).

0 Karma

hjwang
Contributor

Does this mean one warm bucket can contain many hot rolled bucket? Because when maxHotSpanSecs set to 90 days, the hot bucket time span should not be more than 90 days, and it should be rolled to warm bucket. so I doubt why the warm bucket time span is more than 90 days

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...