We recently made several indexes.conf file changes, notably changing our bucket size from 5GB to 1GB. Along with this, we changed our MaxHotBuckets and MaxWarmDBCount to align with our new bucket size of 1GB.
As we still have many of our 5GB buckets in our WARM location, we are not reaching our max for WARM buckets, before hitting our MaxTotalDataSizeinMB.
Result = COLD data freezing sooner than we'd like and our HOT/WARM data location filling up.
What is the process for moving WARM buckets to COLD manually?
All you need to do is stop Splunk, then move the buckets from the hot directory to the cold one, the start Splunk. Generally, you move the lowest numbered ones first, but really, you move the ones with the oldest most recent data first.
I was looking for a way to manually do this, rather than manipulate how splunk automatically does it. I ended up going the route suggested in this article and above as I was running into disk full issues.