Deployment Architecture

auto_high_volume vs hardset to 10GB ?

the_wolverine
Champion

Is setting auto_high_volume the same as setting bucket size to 10GB? Or, does auto_high_volume give a variable bucket size? I'm trying to size my indexes and need to know this.

Are there any pros/cons of using one vs. the other?

1 Solution

Simeon
Splunk Employee
Splunk Employee

In 4.2.1, you do not need to account for bucket sizes to figure out how to partition. You can easily set the hot/warm and cold with specific parameters:

[volume:volume_name]
maxVolumeDataSizeMB = <integer>

In general, auto_high_volume works well and you should not be required to perform manual bucket sizing. Review the indexes.conf.spec or example file for more information.

To answer the setting question, "auto_high_volume" sets the size to 10GB on 64-bit, and 1GB on 32-bit systems.

View solution in original post

Simeon
Splunk Employee
Splunk Employee

In 4.2.1, you do not need to account for bucket sizes to figure out how to partition. You can easily set the hot/warm and cold with specific parameters:

[volume:volume_name]
maxVolumeDataSizeMB = <integer>

In general, auto_high_volume works well and you should not be required to perform manual bucket sizing. Review the indexes.conf.spec or example file for more information.

To answer the setting question, "auto_high_volume" sets the size to 10GB on 64-bit, and 1GB on 32-bit systems.

Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...