If the parameter maxConcurrentOptimizes is not defined for an index in indexes.conf, will Splunk assign a value for it at runtime?
The default value for maxConcurrentOptimizes is 3. If it's not defined in indexes.conf I would assume it uses the default but not completely sure. Best to include it with the default unless you need to increase as the documentation says:
This number should be increased if:
* There are always many small tsidx files in the hot DB.
* After rolling, there are many tsidx files in warm or cold DB.
The default value for maxConcurrentOptimizes is 3. If it's not defined in indexes.conf I would assume it uses the default but not completely sure. Best to include it with the default unless you need to increase as the documentation says:
This number should be increased if:
* There are always many small tsidx files in the hot DB.
* After rolling, there are many tsidx files in warm or cold DB.
On Splunk 6x it is increased to 6 by default, are there any recommendations for dedicated cluster node indexers? I feel that this value is a bit low for dedicated cluster nodes receiving over 200gb of data each day