Hi @lguinn [Splunk],
Based on your points and if my requirement is 30 day ACTIVE and 90 day COLD storage with same storage for hot,warm & cold, while assuming Avg indexed data per day for main index=1Gb, would the following settings be right ?
maxDataSize = 1000
maxHotBuckets= 3
maxWarmDBCount = 31
homePath.maxDataSizeMB = 32000 (data size equivalent of 30 days + extra)
coldPath.maxDataSizeMB = 90000 (data size equivalent of 90 days)
maxTotalDataSizeMB = 122000
frozenTimePeriodInSecs = 10368000
Thanks,
Dev
... View more