All Apps and Add-ons

Two attributes defined in indexes.conf on cold bucket, which one supercedes the other

mmohiuddin
Path Finder

Hi

I have two attributes defined for cold buckets.

500 GB

coldPath.maxDataSizeMB = 512000

395 days

frozenTimePeriodInSecs = 34128000

Which one of the above attributes supersedes the other. I am afraid that if the frozenTime PeriodInSecs takes precedence that it will cause serious strain on disk storage and we might run out of disk space soon on the indexer.

Please let me know.

Thanks.

Tags (1)
0 Karma

OMohi
Path Finder

Thanks for your reply guys.

0 Karma

gfuente
Motivator

Hello

Both settings are applied, so as soon as any of them reaches the limit defined, it will start to roll out to frozen the buckets.

In the other hand, it could happen that if your indexed data grows to 500GB in just one month, then it will start to roll to frozen and you wont have the 1 year data retention desired.

Regards

0 Karma

schoi
Splunk Employee
Splunk Employee

Both settings take effect -- so if either of those conditions are met, buckets will start to freeze.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...