In indexes.conf, it is given that "maxDataSize: The maximum size in MB for a hot DB to reach before a roll to warm is triggered". What parameter is defined to set size for warm buckets and the cold buckets?
Hi,
you have multiple configuration parameter for roling buckets.
Hot to Warm:
maxHotBuckets=<integer>
maxHotSpanSecs=<integer>
Hot/Warm to Cold:
homepath.maxDataSizeMB=<integer> |this is the max Data size for hot and warm db
Warm to Cold:
maxwarmDBCount=<integer>
Cold to Frozen:
coldPath.maxDataSize=<integer>
And the last is for the retention on the index
maxTotalDataSizeMB=<integer>
frozenTimePeriodInSecs=<integer>
Check this paramenter on the indexes.conf Documentation.
Hope this helps
kind regards
Hi,
you have multiple configuration parameter for roling buckets.
Hot to Warm:
maxHotBuckets=<integer>
maxHotSpanSecs=<integer>
Hot/Warm to Cold:
homepath.maxDataSizeMB=<integer> |this is the max Data size for hot and warm db
Warm to Cold:
maxwarmDBCount=<integer>
Cold to Frozen:
coldPath.maxDataSize=<integer>
And the last is for the retention on the index
maxTotalDataSizeMB=<integer>
frozenTimePeriodInSecs=<integer>
Check this paramenter on the indexes.conf Documentation.
Hope this helps
kind regards
Thank you for your reply. Is there any way to set maximum size of warm bucket similar to hot bucket. Because homepath.maxDataSizeMB=0 by default it suggest there are no constraints on homepath size. what max size each of 300(by default) warm buckets take .
Hello, I think coldPath.maxDataSize=INTEGER might be coldPath.maxDataSizeMB=INTEGER. There is a maxDataSize without MB but this is for hot to warm.
The maximum size of a warm bucket must be the maximum size of a hot bucket. The difference between hot and warm buckets is, that a hot bucket is Open for write Operations. After the hot bucket is full It is rotated to a non writable only readable warm bucket. As you see you define the warm buckets through your hot buckets.
Is this what you wanted to know?
Yup, I got the complete picture. Thank you so much. You are the best. May I no for what configuration changes the indexer restarts ,. I am confused because for congurations changes like creating indexes using indexes.conf and pushing those changes to indexes using CM do not result in indexers restart.
Just look at the following link. There is explained which Changes generate a restart or a reload of the indexer Cluster Peers.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Updatepeerconfigurations
Kind regards