Hi, I am currently setting up retention for an index, I want a retention period of 1 year where after that period the data will be deleted.
But worried about the data moving from hot/warm to cold so that my retention will be enforced.
My daily data ingestion to this index is 50 MB, Decided to add maxHotSpanSecs- which is for 24 hours after that period data will roll to warm bucket.
As my data ingestion is low, I want to add stanza maxWarmDBCount = 10 , assuming by specifying 10 in it- it means each bucket on a 64-bit system can take up to 10gb of space, 10 buckets means will take around 100GB then data will roll to cold.
So 50 MB/day ingestion it will take around 200 days to fill one bucket?
Please give me some clear concept on it, How can I set it up :
[xxxxxxx]
homePath = $SPLUNK_DB/xxxxxxxxxx/db
ColdPath = $SPLUNK_DB/xxxxxxxxxx/colddb
thawedPath = $SPLUNK_DB/xxxxxxx/thaweddb
repFactor = auto
maxHotSpanSecs = 86400
maxWarmDBCount = 10
frozenTimePeriodInSecs = 31104000
... View more