Data rolls off due to a few reasons.
Data arrives in Splunk, it then needs to move through HOT/WARM>COLD/FROZEN, otherwise data will build up and you will run out of space.
1.Warm buckets move cold when either the homePath or maxWarmDBCount reach their limits.
2.Cold buckets are deleted when either the frozenTimePeriodInSecs or maxTotalDataSizeMB reach their limits.
This may help show why it’s moving – see the event_message field
index=_internal sourcetype=splunkd component=BucketMover
| fields _time, bucket, candidate, component, event_message, from, frozenTimePeriodInSecs, host, idx,latest, log_level, now, reason, splunk_server, to
| fieldformat "now"=strftime('now', "%Y/%m/%d %H:%M:%S")
| fieldformat "latest"=strftime('latest', "%Y/%m/%d %H:%M:%S")
| eval retention_days = frozenTimePeriodInSecs / 86400
| table _time component, bucket, from, to, candidate, event_message, from, frozenTimePeriodInSecs, retention_days, host, idx, now, latest, reason, splunk_server, log_level
You apply config via indexes.conf for the index for disk constrains by configuring the various options:
Settings:
frozenTimePeriodInSecs (Retention Period in seconds - Old bucket data is deleted (option to freeze it) based on the newest event -
maxTotalDataSizeMB = (Limits the overall size of the index - (hot, warm, cold moves frozen)
maxVolumeDataSizeMB = (limits the total size of all databases that reside on this volume)
maxWarmDBCount = (The maximum number of warm buckets moves to cold)
maxHotBuckets = (The number of actively written open buckets - when exceeded it moves to warm state)
maxHotSpanSecs = (Specifies how long a bucket remains in the hot/warm state before moving to cold)
maxDataSize = (specifies that a hot bucket can reach before splunkd triggers a roll to warm)
maxVolumeDataSizeMB = (Overall Volume Size limit)
homePath.maxDataSizeMB = (limit the individual index size)
coldPath.maxDataSizeMB = (limit the individual index size)
maxVolumeDataSizeMB = (limits the total size of all databases that reside on this volume)
See the indexes.conf for details
https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Indexesconf
... View more