Getting Data In

maxHotSpanSecs

hjwang
Contributor

Hi~splunkers

According to the spec in indexes.conf, it stats the maxHotSpanSecs is Upper bound of target max timespan of hot/warm buckets in seconds and defaults to 90 days, but i want to make sure if this means that the warm_bucket time span will be within this setting interval. Because i found some warm_bucket like db_lastest_earliest, its interval is more than 90 days.

thanks a lot.

Tags (1)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Data isn't written to warm buckets, it is only written to a bucket when it is hot. So that setting should take effect when data is hot and then the data would be rolled to warm, cold, frozen, etc.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

Data isn't written to warm buckets, it is only written to a bucket when it is hot. So that setting should take effect when data is hot and then the data would be rolled to warm, cold, frozen, etc.

lguinn2
Legend

No, a single hot bucket is "rolled" to a single warm bucket (via a simple filesystem rename).

0 Karma

hjwang
Contributor

Does this mean one warm bucket can contain many hot rolled bucket? Because when maxHotSpanSecs set to 90 days, the hot bucket time span should not be more than 90 days, and it should be rolled to warm bucket. so I doubt why the warm bucket time span is more than 90 days

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...