Getting Data In

Help in Configuring Indexes.conf

pe_morris_ter
New Member

Hello Guys,

I am trying to configure the indexes.conf, Here is the scenario, I need to have hot bucket for 6 months, warm & cold to another 6 months, after one year the data must follow to frozen bucket. I have defined following settings. Does it comes under Splunk best practices, Below is my index setting

[volume:A]
maxVolumeDataSizeMB = 1000000

[test_index]
homePath = volume:A/test_index/db
coldPath = volume:A/test_index/colddb
thawedPath = $SPLUNK_DB/test_index/thawedd
maxHotBuckets = 10
maxDataSize = 15000
maxHotSpanSecs = 15760000
coldToFrozenDir = /path/
maxTotalDataSizeMB = 1000000
frozenTimePeriodInSecs = 31104000

0 Karma

vishaltaneja070
Motivator

Hi,

Above mentioned indexes.conf file looks fine. But in maxDataSize stanza you need to mention, the max data size is for which path, homepath(i.e. Hot and Warm) or coldpath(i.e. Cold )

Like homepath.maxDataSize=15000

Remaining things looks cool.

Thanks.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...