mxHotBuckets in Splunk Indexes

[PramodhKumar]

Hi Guys,

What does maxHotBuckets does,

Let's say if I don't set it, its value is 3 then will my indexer have 3 hot buckets every time or will it have depending on amount of data arrival.

For ex: if an index is ingesting 500MB per day(summary index on real time index search) then it just uses one hot bucket instead of 3?

any advice - highly appreciated.

Pramodh

[PavelP]

according to https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf

maxHotBuckets = <positive integer>
* Maximum number of hot buckets that can exist per index.
* When 'maxHotBuckets' is exceeded, Splunk rolls the least recently used (LRU)
  hot bucket to warm.
* Both normal hot buckets and quarantined hot buckets count towards this
  total.
* This setting operates independently of maxHotIdleSecs, which can also
  cause hot buckets to roll.
* NOTE: Splunkd applies this limit per ingestion pipeline. For more
  information about multiple ingestion pipelines, see
  'parallelIngestionPipelines' in the server.conf.spec file.
* With N parallel ingestion pipelines, the maximum number of hot buckets across
  all of the ingestion pipelines is N * 'maxHotBuckets', but only
  'maxHotBuckets' for each ingestion pipeline. Each ingestion pipeline
  independently writes to and manages up to 'maxHotBuckets' number of hot
  buckets. As a consequence of this, when multiple ingestion pipelines are
  used, there may be multiple (dependent on number of ingestion pipelines
  configured) hot buckets with events with overlapping time ranges.
* The highest legal value is 4294967295
* Default: 3

Let's say if I don't set it, its value is 3 then will my indexer have 3 hot buckets every time or will it have depending on amount of data arrival - every time max 3 hot buckets unless you have multiple ingestion pipelines

if an index is ingesting 500MB per day(summary index on real time index search) then it just uses one hot bucket instead of 3? - yes, usually you will see only one hot bucket