#NUMBER OF SPLUNK .CONF ATTENDEES ARCHIVE#

Therefore, if you don't use maxHotSpanSecs in your configuration your data retention for your index will look like this:ģ hot buckets for 90 days (default maxHotSpanSecs is 90 days, default hot buckets is 3)ģ hot bucket for 90 days + 3 warm bucket for 180 daysģ hot buckets for 90 days + 3 warm buckets for 180 days + 3 warm buckets for 270 daysģ hot buckets for 90 days + 3 warm buckets for 180 days + 3 warm buckets for 270 days + 3 warm buckets for 360 days The buckets will only get removed after the frozenTimePeriodInSecs limit is reach for the MOST RECENT EVENT in that bucket. This means these buckets will not get rolled to cold, because for this index you have 100GB of bucket space for a 50MB / day data source. In your configuration, it means you'll have at most 10 buckets in warm that are 10GB in size (or about 2,000 days in length). This DEFINITELY means the number of buckets, and not the number of days. (will roll them to cold as soon as it can) * If set to zero, Splunk will not retain any warm buckets * Warm buckets are located in the for the index.

#NUMBER OF SPLUNK .CONF ATTENDEES ARCHIVE#

This is probably not the behavior you want, because you'll have cold buckets that can stay almost 200 days past the archive date, and they will be 10GB in size.Īs for maxWarmDbCount, according to the latest. This defaults to 500GB.), then yes, the hot buckets will wait to fill up to 10GB (~200 days of your 50MB / day), unless you restart Splunk (at which point, all hot buckets get rolled to warm) frequently. If you're NOT using maxHotSpanSecs AND maxDataSize = auto_high_volume (not maxTotalDataSizeMB, which relates to the total size of an index.

Number of splunk .conf attendees