Deployment Architecture

How much time a bucket can be rolled?

ayushchoudhary
Path Finder

Hello,

I want to know that is all the buckets are rolled every time we restart the indexer and is it safe.?
Is there any specific time a bucket can be rolled.?
will the restart of indexer will effect the buckets/indexes/searches?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi ayushchoudhary,
buckets are rolled when time is the one you configured (or by default) or bucket dimension is the one you configured (or by default), rolling action isn't specificately related to Splunk restart, it's related to time and dimension configured.
Remeber that a bucket is rolled (or deleted after retention time) when the newest event exeed the configured time or the max configured dimension.

The rolling process is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes, instead rolling configuration is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Indexesconf.

Indexer restart will effect the buckets/indexes/searches if you modified some configuration (e.g. change index retention), otherwise buckets roling is subject to splunk configuration (time & dimentions).
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ayushchoudhary,
buckets are rolled when time is the one you configured (or by default) or bucket dimension is the one you configured (or by default), rolling action isn't specificately related to Splunk restart, it's related to time and dimension configured.
Remeber that a bucket is rolled (or deleted after retention time) when the newest event exeed the configured time or the max configured dimension.

The rolling process is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes, instead rolling configuration is described at http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Indexesconf.

Indexer restart will effect the buckets/indexes/searches if you modified some configuration (e.g. change index retention), otherwise buckets roling is subject to splunk configuration (time & dimentions).
Bye.
Giuseppe

0 Karma

brreeves_splunk
Splunk Employee
Splunk Employee

@cusello,
Just to add 1 correction: Hot buckets DO get rolled to warm upon SplunkD restart. ( http://docs.splunk.com/Documentation/Splunk/6.5.3/Indexer/HowSplunkstoresindexes#How_data_ages )

Also, please put a space after your first link (before the comma) so that the link gets you to the right place.

Otherwise, you're correct. 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...