Why can't I set maxHotBuckets > 10 ?

[the_wolverine]

We have an index that receives a lot of events resulting in buckets with 2 hour spans. I initially figured I would give this index 20 hot buckets by setting maxHotBuckets = 20 in indexes.conf.

After seeing the following message in splunkd.log, I think this actually caused issues on my indexer:

04-06-2011 21:13:13.505 INFO  HotDBManager - flushing db: $SPLUNK_DB/defaultdb/db/hot_v1_XXXX (max=10, count=11 )

When I set the value back to 10 hot buckets, the INFO message went away. Is this intentional to not allow > 10 hot buckets? And what is the reasoning?

[the_wolverine · Accepted solution]

There hasn't been a response to this question. If you encounter the same issue I suggest filing a support ticket.

[the_wolverine]

Could someone look into this and let me know whether this is a bug? However, based on Vishal's response, it appears that the behavior I'm seeing is unintended (= Bug).

[Vishal_Patel]

wolverine, that message is not an ERROR, it is simply an INFO message stating that we are going to roll this bucket since it has exceeded maxHotBuckets count.

Please do the following to diagnose why it isn't set to 20:

% splunk cmd btool indexes list main

and verify that the maxHotBuckets is indeed set to 20, if not, you have a conf loading issue

[the_wolverine]

Still waiting for a response 5.5 months later.

[the_wolverine]

I have verified that the update to indexes.conf is being loaded correctly per the command you provided, Vishal.

[the_wolverine]

Pardon my nomenclature! I've updated my post to reflect this. What do I do once I confirm that this is a conf loading issue? Note that the INFO message went away after I changed my maxHotBuckets count to 10.