How much time a bucket can be rolled?

[ayushchoudhary]

Hello,

I want to know that is all the buckets are rolled every time we restart the indexer and is it safe.?
Is there any specific time a bucket can be rolled.?
will the restart of indexer will effect the buckets/indexes/searches?

[gcusello · Accepted solution]

Hi ayushchoudhary,
buckets are rolled when time is the one you configured (or by default) or bucket dimension is the one you configured (or by default), rolling action isn't specificately related to Splunk restart, it's related to time and dimension configured.
Remeber that a bucket is rolled (or deleted after retention time) when the newest event exeed the configured time or the max configured dimension.

The rolling process is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes, instead rolling configuration is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Indexesconf.

Indexer restart will effect the buckets/indexes/searches if you modified some configuration (e.g. change index retention), otherwise buckets roling is subject to splunk configuration (time & dimentions).
Bye.
Giuseppe

[brreeves_splunk]

@cusello,
Just to add 1 correction: Hot buckets DO get rolled to warm upon SplunkD restart. ( http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes#How_data_ages )

Also, please put a space after your first link (before the comma) so that the link gets you to the right place.

Otherwise, you're correct. 🙂