All Apps and Add-ons

Two attributes defined in indexes.conf on cold bucket, which one supercedes the other

mmohiuddin
Path Finder

Hi

I have two attributes defined for cold buckets.

500 GB

coldPath.maxDataSizeMB = 512000

395 days

frozenTimePeriodInSecs = 34128000

Which one of the above attributes supersedes the other. I am afraid that if the frozenTime PeriodInSecs takes precedence that it will cause serious strain on disk storage and we might run out of disk space soon on the indexer.

Please let me know.

Thanks.

Tags (1)
0 Karma

OMohi
Path Finder

Thanks for your reply guys.

0 Karma

gfuente
Motivator

Hello

Both settings are applied, so as soon as any of them reaches the limit defined, it will start to roll out to frozen the buckets.

In the other hand, it could happen that if your indexed data grows to 500GB in just one month, then it will start to roll to frozen and you wont have the 1 year data retention desired.

Regards

0 Karma

schoi
Splunk Employee
Splunk Employee

Both settings take effect -- so if either of those conditions are met, buckets will start to freeze.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...