Hi All,
I have total of 30 GB of total data to be indexed which after indexing will be 15 GB as per splunk average compressing.
I have a total of 4 indexers with 1 TB of disk space. Can you please let me know the indexes.conf setting on each indexer for a retention of 90 days of searchable data in splunk. Does the below settings work or there can be some improvements that can be made?
I got this from the splunk sizing app.
http://splunk-sizing.appspot.com/#ar=0&cdv=1&cr=90&ds=1024&hwr=14&i=4&v=30
indexes.conf
# volume definitions
# index definition (calculation is based on a single index) [index_name] homePath = volume:hotwarm_cold/defaultdb/db coldPath = volume:hotwarm_cold/defaultdb/colddb thawedPath = $SPLUNK_DB/defaultdb/thaweddb homePath.maxDataSizeMB = 53760 coldPath.maxDataSizeMB = 345600 maxWarmDBCount = 4294967295 frozenTimePeriodInSecs = 8985600 maxDataSize = auto
@richgalloway , any suggestions regarding the maxHotBuckets and maxWarmDBCount. Any best practise rearding those? What if I remove these two parameters and the config file looks like below. Will this be better or the previous settings?
# index definition (calculation is based on a single index) [index_name] homePath = volume:hotwarm_cold/defaultdb/db coldPath = volume:hotwarm_cold/defaultdb/colddb thawedPath = $SPLUNK_DB/defaultdb/thaweddb homePath.maxDataSizeMB = 53760 coldPath.maxDataSizeMB = 345600 frozenTimePeriodInSecs = 8985600 maxDataSize = auto_high_volume