What initiates the data rotation between buckets?

0	Hi all, which of the following initiates data rotation between buckets. Is it the time from which the event is indexed or is it the timestamp attached to the event? Cheers, James rotation bucket asked 11 May '11, 20:18 jamesaaronde... 100●8 accept rate: 20%

One Answer:

oldest newest most voted

Hi James, neither of them if you talk about hot/warm buckets. Those are created and rotated solely based on the size and number of those already in these statuses.

Older hot buckets are rolled to warm when they are more than maxHotBuckets, each as big as maxDataSize specifies (plus some other idle data rules...).
Older warm buckets are rolled to cold when they are more than maxWarmDBCount.
Older cold buckets are rolled to frozen when their latest event timestamp is older than frozenTimePeriodInSecs.
Also, if the index grows more than maxTotalDataSizeMB, the oldest data is rolled to frozen.

Some more settings may be applied, please check the Index.conf docs for that.

Paolo

link

answered 12 May '11, 00:16

Paolo Prigione
2.0k●2●3●17
accept rate: 38%

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

bucket ×26
rotation ×7

Asked: 11 May '11, 20:18

Seen: 1,001 times

Last updated: 12 May '11, 00:16

What initiates the data rotation between buckets?

Follow this question

Splunk Resources

Related questions