Hi All,
I have few concerns regarding buck rolling criteria my question is more focused on hot bucket.
So we have 2 types of index 1. Default 2. Local or customized i...
When one of the indexers fails, I have a problem with the growth of buckets on the working indexer. If one of the indexers is not available, should I change the bucket policy? I currently have RF:2...
When one configures the indexer cluster for SmartStore, does each indexer get its own S3 bucket? Or is there just one very large S3 bucket and all indexers write into the same S3 bucket (s...
...s resolved, I have created this new thread. The issue is about error message observed in Splunk index=_internal: - Failed to read size=1 event(s) from rawdata in bucket Rawdata may be corrupt, s...
Hi We have a splunk installation with smart store enabled. We have plenty of cache on disk, so we are no near the space padding setting. I have seen bucket downloads from the S3, and I d...
Hi,
As soon as data moves from cold to frozen bucket it gets deleted? How data moves from frozen bucket to Thawed bucket. The data in thawed bucket is that searchable? How long data will be in t...
Hi, I have one index(test0) in a standalone server. I'm trying to make 3-month data searchable after 6 months of data to Archive And after 12 months of data to delete/retention Below is my con...
Hi, I have buckets in my pending fixup tasks on my cluster master that have status: "Cannot replicate as bucket hasn't rolled yet". What confuses me is they are all frozen and already been d...
Please confirm something or correct me. If I understand correctly, it's the event's _time that's the basis for bucket ageing (hot->warm->cold(->frozen)), right? I understand that it's t...
Hi, this error message started popping up, on Splunk Cloud. As you already know in Splunk Cloud you do not have access by SSH to the internal files of Splunk, bin, etc. Why is it and how ca...