Storage issues on indexer

[Reethika]

Is it normal to have colddb > db?

4.0K    thaweddb
20M     summary
4.2G    datamodel_summary
9.8G    db
59G     colddb
[root@xxxxxxxplunkdata/_internaldb

[gcusello]

Hi @Reethika ,

it depends on the parameters you configured in your Splunk installation,

as you can see in https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf there are many parameters to configure how long a bucket remains in Warm Data (db) and how long it remains in Cold Data (colddb).

at first, what's the retention of your archive? if you have a long retention (frozenTimePriodInSeconds), buckets stay most time in Cold State.

if you leave the the number of warm as default and you have many data, the pass quickly from Warm to Cold (default of maxWarmDbCount is 300).

In other words it's normal, unless you setted a different configuration.

Ciao.

Giuseppe