Splunk Search

whats happens when hot buckets are not specified ?

Path Finder


Can i please know what happens if maxHotBuckets is not specified , when will splunk roll the buckets from hot to warm ?

0 Karma


From the documentation https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Indexesconf
Defaults to 3

maxHotBuckets =
* Maximum hot buckets that can exist per index.

  • When maxHotBuckets is exceeded, Splunk rolls the least recently used (LRU) hot bucket to warm.
  • Both normal hot buckets and quarantined hot buckets count towards this total.
  • This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
  • Highest legal value is 4294967295
  • Defaults to 3.