whats happens when hot buckets are not specified ?

[kteng2024]

hi,

Can i please know what happens if maxHotBuckets is not specified , when will splunk roll the buckets from hot to warm ?

[pradeepkumarg]

From the documentation https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Indexesconf
Defaults to 3

maxHotBuckets =
* Maximum hot buckets that can exist per index.

• When maxHotBuckets is exceeded, Splunk rolls the least recently used (LRU) hot bucket to warm.
• Both normal hot buckets and quarantined hot buckets count towards this total.
• This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
• Highest legal value is 4294967295
• Defaults to 3.