according to https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf
maxHotBuckets = <positive integer>
* Maximum number of hot buckets that can exist per index.
* When 'maxHotBuckets' is exceeded, Splunk rolls the least recently used (LRU)
hot bucket to warm.
* Both normal hot buckets and quarantined hot buckets count towards this
total.
* This setting operates independently of maxHotIdleSecs, which can also
cause hot buckets to roll.
* NOTE: Splunkd applies this limit per ingestion pipeline. For more
information about multiple ingestion pipelines, see
'parallelIngestionPipelines' in the server.conf.spec file.
* With N parallel ingestion pipelines, the maximum number of hot buckets across
all of the ingestion pipelines is N * 'maxHotBuckets', but only
'maxHotBuckets' for each ingestion pipeline. Each ingestion pipeline
independently writes to and manages up to 'maxHotBuckets' number of hot
buckets. As a consequence of this, when multiple ingestion pipelines are
used, there may be multiple (dependent on number of ingestion pipelines
configured) hot buckets with events with overlapping time ranges.
* The highest legal value is 4294967295
* Default: 3
Let's say if I don't set it, its value is 3 then will my indexer have 3 hot buckets every time or will it have depending on amount of data arrival - every time max 3 hot buckets unless you have multiple ingestion pipelines
if an index is ingesting 500MB per day(summary index on real time index search) then it just uses one hot bucket instead of 3? - yes, usually you will see only one hot bucket
