In my indexes.conf file (C:\Program Files\Splunk\etc\system\local) I have the attribute "maxHotIdleSecs = 86400"
So in other words I want hot buckets to roll over to a warm bucket after it's been in existence for 24 hours.
After my initial addition of this attribute, and restart, ALL hot buckets that were over 24 hours old rolled over to warm buckets. But then the next day I had buckets that were over 24 hours old again, and they wouldn't roll over, until I restarted splunk again.
Do Indexes.conf attributes take precedence over others? Because I do have a "maxDataSize" attribute that my buckets never meet. Or should these buckets jsut roll over whenever one of these attributes are met?
... View more