Deployment Architecture

auto_high_volume vs hardset to 10GB ?

the_wolverine
Champion

Is setting auto_high_volume the same as setting bucket size to 10GB? Or, does auto_high_volume give a variable bucket size? I'm trying to size my indexes and need to know this.

Are there any pros/cons of using one vs. the other?

1 Solution

Simeon
Splunk Employee
Splunk Employee

In 4.2.1, you do not need to account for bucket sizes to figure out how to partition. You can easily set the hot/warm and cold with specific parameters:

[volume:volume_name]
maxVolumeDataSizeMB = <integer>

In general, auto_high_volume works well and you should not be required to perform manual bucket sizing. Review the indexes.conf.spec or example file for more information.

To answer the setting question, "auto_high_volume" sets the size to 10GB on 64-bit, and 1GB on 32-bit systems.

View solution in original post

Simeon
Splunk Employee
Splunk Employee

In 4.2.1, you do not need to account for bucket sizes to figure out how to partition. You can easily set the hot/warm and cold with specific parameters:

[volume:volume_name]
maxVolumeDataSizeMB = <integer>

In general, auto_high_volume works well and you should not be required to perform manual bucket sizing. Review the indexes.conf.spec or example file for more information.

To answer the setting question, "auto_high_volume" sets the size to 10GB on 64-bit, and 1GB on 32-bit systems.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...