Deployment Architecture

How to set a time limit for buckets to remain warm

rmcdougal
Path Finder

I know that there is a setting for how long a bucket will remain hot

maxHotSpanSecs

I also know there is a setting for how long before a bucket is either deleted or moved to frozen

frozenTimePeriodInSecs

But, what about time between warm and cold? Also, is there truly any difference between warm and cold other than name?

Tags (2)
0 Karma

sowings
Splunk Employee
Splunk Employee

In short, no.

There isn't much difference between warm and cold. The form of the bucket itself is identical in both states. (In hot, the bucket is still being written to.) Warm and cold buckets are static, and both are searchable. The warm to cold transition is the first boundary that lets us change partition. Consider a case where you have "fast" storage like an SSD, and "slow" storage like 5400 RPM rotating disks, and you want to keep stuff you search often on the SSDs. This is the most common use case for the warm to cold transition.

The usual way in trying to "keep buckets warm" is to enforce a count of buckets. Usually, this is a space constraint, rather than a time-based constraint, so people tune this with "if buckets can be up to 10G, and I have 300G of hot/warm storage, I can have a max of 30 warm buckets" (but don't forget to include the hot buckets, so really 27 warm buckets), and use the maxWarmDBCount parameter.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...