Security

mxHotBuckets in Splunk Indexes

PramodhKumar
Explorer

Hi Guys,

What does maxHotBuckets does,

Let's say if I don't set it, its value is 3 then will my indexer have 3 hot buckets every time or will it have depending on amount of data arrival.

For ex: if an index is ingesting 500MB per day(summary index on real time index search) then it just uses one hot bucket instead of 3?

any advice - highly appreciated.

Pramodh

Tags (1)
0 Karma

PavelP
Motivator

according to https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf

maxHotBuckets = <positive integer>
* Maximum number of hot buckets that can exist per index.
* When 'maxHotBuckets' is exceeded, Splunk rolls the least recently used (LRU)
  hot bucket to warm.
* Both normal hot buckets and quarantined hot buckets count towards this
  total.
* This setting operates independently of maxHotIdleSecs, which can also
  cause hot buckets to roll.
* NOTE: Splunkd applies this limit per ingestion pipeline. For more
  information about multiple ingestion pipelines, see
  'parallelIngestionPipelines' in the server.conf.spec file.
* With N parallel ingestion pipelines, the maximum number of hot buckets across
  all of the ingestion pipelines is N * 'maxHotBuckets', but only
  'maxHotBuckets' for each ingestion pipeline. Each ingestion pipeline
  independently writes to and manages up to 'maxHotBuckets' number of hot
  buckets. As a consequence of this, when multiple ingestion pipelines are
  used, there may be multiple (dependent on number of ingestion pipelines
  configured) hot buckets with events with overlapping time ranges.
* The highest legal value is 4294967295
* Default: 3

Let's say if I don't set it, its value is 3 then will my indexer have 3 hot buckets every time or will it have depending on amount of data arrival - every time max 3 hot buckets unless you have multiple ingestion pipelines

if an index is ingesting 500MB per day(summary index on real time index search) then it just uses one hot bucket instead of 3? - yes, usually you will see only one hot bucket

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...