Splunk Enterprise Security

Anyone able to help me tune my indexes.conf?

daniel333
Builder

All,

Sorry guys, don't do this much and the docs are not giving me the warm and fuzzy's about about how to do this.

I'd like to take advantage of the fact I have pretty snappy local disks on my new servers to keep a day or two logs events there before rolling to cold. Never really done this before. Where I am running into trouble here is that config for the hot/warm. What's the setting here to get Splunk rolling from FASTDISk to BIGDISk isntead of just running out of space and crashing? Does Splunk just "know" as it appraoches 700gigs to start rolling? I assume this would be volume level setting but not seeing it.

 # 12TB store
[volume:bigdisk]
  path = /data
  maxVolumeDataSizeMB = 110000000

# 1TB local SSDs
[volume:fastdisk]
  path = /splunk_local
  maxVolumeDataSizeMB = 700000

[default]
  # 10gig buckets
  maxDataSize = auto_high_volume
  # Company requires min 120 day logs available
  frozenTimePeriodInSecs=36820000

  # Hot/Warm - should just roll to cold when fastdisk is low on space
  homePath = volume:fastdisk/$_index_name/db
  homePath.maxDataSizeMB = 700000

  # Cold - should drop data when full - not crash
  coldPath = volume:bigdisk/$_index_name/colddb
  coldPath.maxDataSizeMB = 110000000
  thawedPath = $SPLUNK_DB/$_index_name/thaweddb

[main]
[os]
[windows]
0 Karma

ddrillic
Ultra Champion

In all the examples I have seen, the following is at the index level -

homePath.maxDataSizeMB = 700000

So, I would try to put it at each index where the accumulative size would be below 700000 MBs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...