indexes.conf - Splunk Documentation (original) (raw)

The following are the spec and example files for indexes.conf.

indexes.conf.spec

Version 9.4.2

OVERVIEW

This file contains all possible options for an indexes.conf file. Use

this file to configure Splunk's indexes and their properties.

Each stanza controls different search commands settings.

There is a indexes.conf file in the $SPLUNK_HOME/etc/system/default/ directory.

Never change or copy the configuration files in the default directory.

The files in the default directory must remain intact and in their original

location.

To set custom configurations, create a new file with the name indexes.conf in

the $SPLUNK_HOME/etc/system/local/ directory. Then add the specific settings

that you want to customize to the local configuration file.

For examples, see indexes.conf.example. You must restart the Splunk instance

to enable configuration changes.

Some settings changes might require a restart or reload. To determine when a

restart or reload is required, refer to the "Managing Indexers and

Clusters of Indexers" documentation:

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Determinerestart

To learn more about configuration files (including file precedence) see the

documentation located at

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

CAUTION: You can drastically affect your Splunk installation by changing

these settings. Consult technical support

(http://www.splunk.com/page/submit_issue) if you are not sure how to

configure this file.

GLOBAL SETTINGS

Use the [default] stanza to define any global settings.

* You can also define global settings outside of any stanza, at the top

of the file.

* Each conf file should have at most one default stanza. If there are

multiple default stanzas, settings are combined. In the case of

multiple definitions of the same setting, the last definition in the

file wins.

* If a setting is defined at both the global level and in a specific

stanza, the value in the specific stanza takes precedence.

sync =

• The index processor syncs events every 'sync' number of events.
• Set to 0 to disable.
• Highest legal value is 32767.
• Default: 0

defaultDatabase =

• If an index is not specified during search, Splunk software searches the default index.
• The specified index displays as the default in Splunk Manager settings.
• Default: main

bucketMerging =

• This setting is supported on indexer clusters when 'storageType' is "remote" or "local". Standalone indexers support "local" only.
• The bucket merge task will evaluate and localize remote buckets before merging.
• Set to true to enable bucket merging service on all indexes
• You can override this value on a per-index basis.
• Default: false

bucketMerge.minMergeSizeMB =

• This setting is supported on indexer clusters when 'storageType' is "remote" or "local". Standalone indexers support "local" only.
• Minimum cumulative bucket sizes to merge.
• You can override this value on a per-index basis.
• Default: 750

bucketMerge.maxMergeSizeMB =

• This setting is supported on indexer clusters when 'storageType' is "remote" or "local". Standalone indexers support "local" only.
• Maximum cumulative bucket sizes to merge.
• You can override this value on a per-index basis.
• Default: 1000

bucketMerge.maxMergeTimeSpanSecs =

• This setting is supported on indexer clusters when 'storageType' is "remote" or "local". Standalone indexers support "local" only.
• Maximum allowed time span, in seconds, between buckets about to be merged.
• You can override this value on a per-index basis.
• Default: 7776000 (90 days)

bucketMerge.minMergeCount =

• This setting is supported on indexer clusters when 'storageType' is "remote" or "local". Standalone indexers support "local" only.
• Minimum number of buckets to merge.
• You can override this value on a per-index basis.
• Default: 2

bucketMerge.maxMergeCount =

• This setting is supported on indexer clusters when 'storageType' is "remote" or "local". Standalone indexers support "local" only.
• Maximum number of buckets to merge.
• You can override this value on a per-index basis.
• Default: 24

queryLanguageDefinition =

• REMOVED. This setting is no longer used.

lastChanceIndex =

• An index that receives events that are otherwise not associated with a valid index.
• If you do not specify a valid index with this setting, such events are dropped entirely.
• Routes the following kinds of events to the specified index:
  • events with a non-existent index specified at an input layer, like an invalid "index" setting in inputs.conf
  • events with a non-existent index computed at index-time, like an invalid _MetaData:Index value set from a "FORMAT" setting in transforms.conf
• You must set 'lastChanceIndex' to an existing, enabled index. Splunk software cannot start otherwise.
• If set to "default", then the default index specified by the 'defaultDatabase' setting is used as a last chance index.
• Default: empty string

malformedEventIndex =

• Currently not supported. This setting is related to a feature that is still under development.
• An index to receive malformed events.
• If you do not specify a valid index with this setting, or Splunk software cannot use the index specified in the 'defaultDatabase' setting, such events are dropped entirely.
• Routes the following kinds of events to the specified index:
  • events destined for read-only indexes
  • log events destined for datatype=metric indexes
  • log events with invalid raw data values, like all-whitespace raw
  • metric events destined for datatype=event indexes
  • metric events with invalid metric values, like non-numeric values
  • metric events lacking required attributes, like metric name
• Malformed events can be modified in order to make them suitable for indexing, as well as to aid in debugging.
• A high volume of malformed events can affect search performance against the specified index; for example, malformed metric events can lead to an excessive number of Strings.data entries
• must refer to an existing, enabled index. Splunk software does not start if this is not the case.
• If set to "default", the indexer places malformed events in the index specified by the 'defaultDatabase' setting
• Default: empty string

memPoolMB = |auto

• Determines how much memory is given to the indexer memory pool. This restricts the number of outstanding events in the indexer at any given time.
• Must be greater than 0; maximum value is 1048576 (which corresponds to 1 TB)
• Setting this too high can cause splunkd memory usage to increase significantly.
• Setting this too low can degrade splunkd indexing performance.
• Setting this to "auto" or an invalid value causes splunkd to autotune the value as follows:
  • System Memory Available less than ... | 'memPoolMB' 1 GB | 64 MB 2 GB | 128 MB 8 GB | 128 MB 16 GB | 256 MB 32 GB | 1 GB 64 GB | 2 GB 64 GB or higher | 4 GB
• Only set this value if you are an expert user or have been advised to by Splunk Support.
• CAUTION: CARELESSNESS IN SETTING THIS CAN LEAD TO LOSS OF JOB.
• Default: auto

indexThreads = |auto

• Determines the number of threads to use for indexing.
• Must be at least 1 and no more than 16.
• This value should not be set higher than the number of processor cores in the machine.
• If splunkd is also doing parsing and aggregation, the number should be set lower than the total number of processors minus two.
• Setting this to "auto" or an invalid value will cause Splunk to autotune this setting.
• Only set this value if you are an expert user or have been advised to by Splunk Support.
• CAUTION: CARELESSNESS IN SETTING THIS CAN LEAD TO LOSS OF JOB.
• Default: auto

rtRouterThreads = 0|1

• Set to "1" if you expect to use non-indexed real time searches regularly. Index throughput drops rapidly if there are a handful of these running concurrently on the system.
• If you are not sure what "indexed vs non-indexed" real time searches are, see README of indexed_realtime* settings in limits.conf
• NOTE: This is not a boolean value. Acceptable values are "0" and "1" ONLY. At the present time, you can only create a single real-time thread per pipeline set.

rtRouterQueueSize =

• This setting is only valid if 'rtRouterThreads' != 0
• This queue sits between the indexer pipeline set thread (producer) and the 'rtRouterThread'
• Changing the size of this queue can impact real-time search performance.
• Default: 10000

selfStorageThreads =

• Specifies the number of threads used to transfer data to customer-owned remote storage.
• The threads are created on demand when any index is configured with self storage options.
• Default: 2

assureUTF8 =

• Verifies that all data retrieved from the index is proper by validating all the byte strings.
  • This does not ensure all data will be emitted, but can be a workaround if an index is corrupted in such a way that the text inside it is no longer valid utf8.
• Will degrade indexing performance when enabled (set to true).
• Can only be set globally, by specifying in the [default] stanza.
• Default: false

enableRealtimeSearch =

• Enables real-time searches.
• Default: true

suppressBannerList =

• suppresses index missing warning banner messages for specified indexes
• Default: empty string

maxRunningProcessGroups = |auto

• The number of child processes that splunkd can run at a given time.
• Splunkd runs helper child processes like "splunk-optimize", "recover-metadata", and so on.
• This maximum applies to all of splunkd, not per index. If you have N indexes, there will be at most 'maxRunningProcessGroups' child processes, not N * 'maxRunningProcessGroups' processes.
• The value for this setting must be higher than the value for the 'maxRunningProcessGroupsLowPriority' setting.
• This is an advanced setting; do NOT set unless instructed by Splunk Support.
• A value of "auto" means splunkd chooses the number of processes automatically based on system characteristics.
• Highest legal value is 4294967295.
• Default: auto

maxRunningProcessGroupsLowPriority =

• Of the 'maxRunningProcessGroups' helper child processes, at most 'maxRunningProcessGroupsLowPriority' may be low-priority (for example, "fsck") ones.
• This maximum applies to all of splunkd, not per index. If you have N indexes, there will be at most 'maxRunningProcessGroupsLowPriority' low-priority child processes, not N * 'maxRunningProcessGroupsLowPriority' processes.
• There must always be fewer 'maxRunningProcessGroupsLowPriority' child processes than there are 'maxRunningProcessGroups' child processes.
• This is an advanced setting; do NOT set unless instructed by Splunk Support.
• Highest legal value is 4294967295.
• Default: 1

bucketRebuildMemoryHint = [KB|MB|GB]|auto

• A suggestion for the bucket rebuild process for the size, in bytes, of the tsidx file it will try to build.
• Larger files use more memory in a rebuild, but rebuilds fail if there is not enough memory.
• Smaller files make the rebuild take longer during the final optimize step.
• NOTE: This value is not a hard limit on either rebuild memory usage or tsidx size.
• This is an advanced setting, do NOT set this unless instructed by Splunk Support.
• If set to "auto", the bucket rebuild process tunes the setting based on the amount of physical RAM on the machine:
  • less than 2GB RAM = 67108864 (64MB) tsidx
  • 2GB to 8GB RAM = 134217728 (128MB) tsidx
  • more than 8GB RAM = 268435456 (256MB) tsidx
• If not set to "auto", then you must set this setting between 16MB and 1GB.
• A value can be specified using a size suffix: "16777216" or "16MB" are equivalent.
• Inappropriate use of this setting causes splunkd to not start if rebuild is required.
• Highest legal value (in bytes) is 4294967295.
• Default: auto

inPlaceUpdates =

• Whether or not splunkd writes metadata updates to .data files in place.
• Intended for advanced debugging of metadata issues.
• If set to "true", metadata updates are written to the .data files directly.
• If set to "false", metadata updates are written to a temporary file and then moved into place.
• Configuring this setting to "false" (to use a temporary file) affects indexing performance, particularly with large numbers of hosts, sources, or sourcetypes (~1 million, across all indexes.)
• This is an advanced setting; do NOT set unless instructed by Splunk Support
• Default: true

serviceInactiveIndexesPeriod =

• How frequently, in seconds, inactive indexes are serviced.
• An inactive index is an index that has not been written to for a period greater than the value of 'serviceMetaPeriod'. The inactive state is not affected by whether the index is being read from.
• The highest legal value is 4294967295.
• Default: 60

serviceOnlyAsNeeded =

• DEPRECATED; use 'serviceInactiveIndexesPeriod' instead.
• Causes index service (housekeeping tasks) overhead to be incurred only after index activity.
• Indexer module problems might be easier to diagnose when this optimization is disabled (set to false).
• Default: true

serviceSubtaskTimingPeriod =

• Subtasks of indexer service task will be timed on every Nth execution, where N = value of this setting, in seconds.
• Smaller values give greater accuracy; larger values lessen timer overhead.
• Timer measurements are found in metrics.log, marked "group=subtask_seconds, task=indexer_service"
• Highest legal value is 4294967295
• Configure a value for this setting that divides evenly into the value for the 'rotatePeriodInSecs' setting where possible.
• Default: 30

processTrackerServiceInterval =

• How often, in seconds, the indexer checks the status of the child OS processes it has launched to see if it can launch new processes for queued requests.
• If set to 0, the indexer checks child process status every second.
• Highest legal value is 4294967295.
• Default: 1

maxBucketSizeCacheEntries =

• This value is no longer needed. Its value is ignored.

tsidxStatsHomePath =

• An absolute path that specifies where the indexer creates namespace data with the 'tscollect' command.
• If the directory does not exist, the indexer attempts to create it.
• Optional.
• NOTE: The "$SPLUNK_DB" directory must be writable.
• Default: $SPLUNK_DB/tsidxstats

tsidxWritingLevel = [1|2|3|4]

• Enables various performance and space-saving improvements for tsidx files.
• Tsidx files written with a higher tsidxWritingLevel setting have limited backward compatibility when searched with lower versions of Splunk Enterprise.
• Setting tsidxWritingLevel globally is recommended. It can also be set per-index.
• For deployments that have multi-site index clustering, change the setting AFTER all your indexers in the cluster have been upgraded to the latest release.
• Default: 3

hotBucketTimeRefreshInterval =

• How often each index refreshes the available hot bucket times used by the 'indexes' REST endpoint.
• A refresh occurs every N times service is performed for each index.
  • For busy indexes, this is a multiple of seconds.
  • For idle indexes, this is a multiple of the second-long-periods in which data is received.
• This setting is only intended to relax the frequency of these refreshes in the unexpected case that it adversely affects performance in unusual production scenarios.
• This time is tracked on a per-index basis, and thus can be adjusted on a per-index basis if needed.
• If you want the index information to be refreshed with every service (and accept minor performance overhead), set to 1.
• Default: 10 (services)

fileSystemExecutorWorkers =

• Determines the number of threads to use for file system io operations.
• This maximum applies to all of splunkd, not per index. If you have N indexes, there will be at most 'fileSystemExecutorWorkers' workers, not N * 'fileSystemExecutorWorkers' workers.
• This is an advanced setting; do NOT set unless instructed by Splunk Support.
• Highest legal value is 4294967295.
• Default: 5

hotBucketStreaming.extraBucketBuildingCmdlineArgs =

• Currently not supported. This setting is related to a feature that is still under development.
• Default: empty

PER INDEX OPTIONS

These options can be set under an [] entry.

Index names must consist of only numbers, lowercase letters, underscores,

and hyphens. They cannot begin with an underscore or hyphen, or contain

the word "kvstore".

#**************************************************************************

disabled =

• Toggles your index entry off and on.
• Set to "true" to disable an index.
• CAUTION: Do not set this setting to "true" on remote storage enabled indexes.
• Default: false

deleted = true

• If present, means that this index has been marked for deletion: if splunkd is running, deletion is in progress; if splunkd is stopped, deletion re-commences on startup.
• Do NOT manually set, clear, or modify the value of this setting.
• CAUTION: Seriously: LEAVE THIS SETTING ALONE.
• No default.

deleteId =

• If present, means that this index has been marked for deletion: if splunkd is running, deletion is in progress; if splunkd is stopped, deletion re-commences on startup.
• Do NOT manually set, clear, or modify the value of this setting.
• CAUTION: Seriously: LEAVE THIS SETTING ALONE.
• No default.

homePath =

• An absolute path that contains the hot and warm buckets for the index.
• Best practice is to specify the path with the following syntax: homePath = SPLUNKDB/SPLUNK_DB/SPLUNKD​B/_index_name/db At runtime, splunkd expands "$_index_name" to the name of the index. For example, if the index name is "newindex", homePath becomes "$SPLUNK_DB/newindex/db".
• Splunkd keeps a file handle open for warmdbs at all times.
• Can contain a volume reference (see volume section below) in place of $SPLUNK_DB.
• CAUTION: The parent path "$SPLUNK_DB/$_index_name/" must be writable.
• Required. Splunkd does not start if an index lacks a valid 'homePath'.
• You must restart splunkd after changing this setting for the changes to take effect.
• Avoid the use of other environment variables in index paths, aside from the possible exception of SPLUNK_DB.
  • As an exception, SPLUNK_DB is explicitly managed by the software, so most possible downsides here do not exist.
  • Environment variables can be different from launch to launch of the software, causing severe problems with management of indexed data, including:
    • Data in the prior location is not searchable.
    • The indexer might not be able to write to the new location, causing outages or data loss.
    • Writing to a new, unexpected location could lead to disk space exhaustion causing additional operational problems.
    • Recovery from such a scenario requires manual intervention and bucket renaming, especially difficult in an index cluster environment.
    • In all circumstances, Splunk Diag, the diagnostic tool that Splunk Support uses, has no way to determine the correct values for the environment variables, and cannot reliably operate. You might need to manually acquire information about your index buckets in troubleshooting scenarios.
  • Volumes provide a more appropriate way to control the storage location for indexes.
• No default.

coldPath =

• An absolute path that contains the colddbs for the index.
• Best practice is to specify the path with the following syntax: coldPath = SPLUNKDB/SPLUNK_DB/SPLUNKD​B/_index_name/colddb At runtime, splunkd expands "$_index_name" to the name of the index. For example, if the index name is "newindex", 'coldPath' becomes "$SPLUNK_DB/newindex/colddb".
• Cold databases are opened as needed when searching.
• Can contain a volume reference (see volume section below) in place of $SPLUNK_DB.
• Path must be writable.
• Required. Splunkd does not start if an index lacks a valid 'coldPath'.
• You must restart splunkd after changing this setting for the changes to take effect. Reloading the index configuration does not suffice.
• Avoid using environment variables in index paths, aside from the possible exception of $SPLUNK_DB. See 'homePath' for additional information as to why.
• Remote-storage-enabled indexes do not cycle buckets from homePath to coldPath. However, if buckets already reside in 'coldPath' for a non-remote-storage-enabled index, and that index is later enabled for remote storage, those buckets will be searchable and will have their life cycle managed.

thawedPath =

• An absolute path that contains the thawed (resurrected) databases for the index.
• CANNOT contain a volume reference.
• Path must be writable.
• Required. Splunkd does not start if an index lacks a valid thawedPath.
• You must restart splunkd after changing this setting for the changes to take effect. Reloading the index configuration does not suffice.
• Avoid the use of environment variables in index paths, aside from the exception of SPLUNK_DB. See 'homePath' for additional information as to why.

bloomHomePath =

• The location where the bloomfilter files for the index are stored.
• If specified, 'bloomHomePath' must be defined in terms of a volume definition (see volume section below).
• If 'bloomHomePath' is not specified, the indexer stores bloomfilter files for the index inline, inside index bucket directories.
• Path must be writable.
• You must restart splunkd after changing this setting for the changes to take effect. Reloading the index configuration does not suffice.
• Avoid the use of environment variables in index paths, aside from the exception of SPLUNK_DB. See 'homePath' for additional information as to why.
• CAUTION: Do not set this setting on indexes that have been configured to use remote storage with the "remotePath" setting.

createBloomfilter =

• Whether or not to create bloomfilter files for the index.
• If set to "true", the indexer creates bloomfilter files.
• If set to "false", the indexer does not create bloomfilter files.
• You must set to "true" for remote storage enabled indexes.
• CAUTION: Do not set this setting to "false" on indexes that have been configured to use remote storage with the "remotePath" setting.
• Default: true

summaryHomePath =

• An absolute path where transparent summarization results for data in this index should be stored.
• This value must be different for each index and can be on any disk drive.
• Best practice is to specify the path with the following syntax: summaryHomePath = SPLUNKDB/SPLUNK_DB/SPLUNKD​B/_index_name/summary At runtime, splunkd expands "$_index_name" to the name of the index. For example, if the index name is "newindex", summaryHomePath becomes "$SPLUNK_DB/newindex/summary".
• Can contain a volume reference (see volume section below) in place of $SPLUNK_DB.
• Volume reference must be used if you want to retain data based on data size.
• Path must be writable.
• If not specified, splunkd creates a directory 'summary' in the same location as 'homePath'.
  • For example, if 'homePath' is "/opt/splunk/var/lib/splunk/index1/db", then 'summaryHomePath' must be "/opt/splunk/var/lib/splunk/index1/summary".
• The parent path must be writable.
• You must not set this setting for remote storage enabled indexes.
• You must restart splunkd after changing this setting for the changes to take effect. Reloading the index configuration does not suffice.
• Avoid the use of environment variables in index paths, aside from the exception of SPLUNK_DB. See 'homePath' for additional information as to why.
• No default.

tstatsHomePath =

• Location where data model acceleration TSIDX data for this index should be stored.
• Required.
• MUST be defined in terms of a volume definition (see volume section below)
• Path must be writable.
• You must not set this setting for remote storage enabled indexes.
• You must restart splunkd after changing this setting for the changes to take effect. Reloading the index configuration does not suffice.
• Default: volume:_splunk_summaries/$_index_name/datamodel_summary, where "$_index_name" is runtime-expanded to the name of the index

remotePath = <root path for remote volume, prefixed by a URI-like scheme>

• Optional.
• Presence of this setting means that this index uses remote storage, instead of the local file system, as the main repository for bucket storage. The index processor works with a cache manager to fetch buckets locally, as necessary, for searching and to evict them from local storage as space fills up and they are no longer needed for searching.
• This setting must be defined in terms of a storageType=remote volume definition. See the volume section below.
• The path portion that follows the volume reference is relative to the path specified for the volume. For example, if the path for a volume "v1" is "s3://bucket/path" and 'remotePath' is "volume:v1/idx1", then the fully qualified path is "s3://bucket/path/idx1". The rules for resolving the relative path with the absolute path specified in the volume can vary depending on the underlying storage type.
• If 'remotePath' is specified, the 'coldPath' and 'thawedPath' settings are ignored. However, you must still specify them.

maxBloomBackfillBucketAge = [smhd]|infinite

• If a (warm or cold) bucket with no bloomfilter is older than this, splunkd does not create a bloomfilter for that bucket.
• When set to 0, splunkd never backfills bloomfilters.
• When set to "infinite", splunkd always backfills bloomfilters.
• NOTE: If 'createBloomfilter' is set to "false", bloomfilters are never backfilled regardless of the value of this setting.
• The highest legal value in computed seconds is 2 billion, or 2000000000, which is approximately 68 years.
• Default: 30d

hotlist_recency_secs =

• When a bucket is older than this value, it becomes eligible for eviction. Buckets younger than this value are evicted only if there are no older buckets eligible for eviction.
• Default: The global setting in the server.conf file [cachemanager] stanza

hotlist_bloom_filter_recency_hours =

• When a bucket's non-journal and non-tsidx files (such as bloomfilter files) are older than this value, those files become eligible for eviction. Bloomfilter and associated files younger than this value are evicted only if there are no older files eligible for eviction.
• Default: The global setting in the server.conf file [cachemanager] stanza

enableOnlineBucketRepair =

• Controls asynchronous "online fsck" bucket repair, which runs concurrently with splunkd.
• When enabled, you do not have to wait until buckets are repaired, to start splunkd.
• When enabled, you might observe a slight degradation in performance.
• You must set to "true" for remote storage enabled indexes.
• Default: true

enableDataIntegrityControl =

• Whether or not splunkd computes hashes on rawdata slices and stores the hashes for future data integrity checks.
• If set to "true", hashes are computed on the rawdata slices.
• If set to "false", no hashes are computed on the rawdata slices.
• Default: false

maxWarmDBCount =

• The maximum number of warm buckets.
• Warm buckets are located in the 'homePath' for the index.
• If set to zero, splunkd does not retain any warm buckets It rolls the buckets to cold as soon as it is able.
• Splunkd ignores this setting on remote storage enabled indexes.
• Highest legal value is 4294967295.
• Default: 300

maxTotalDataSizeMB =

• The maximum size of an index, in megabytes.
• If an index grows larger than the maximum size, splunkd freezes the oldest data in the index.
• This setting applies only to hot, warm, and cold buckets. It does not apply to thawed buckets.
• CAUTION: The 'maxTotalDataSizeMB' size limit can be reached before the time limit defined in 'frozenTimePeriodInSecs' due to the way bucket time spans are calculated. When the 'maxTotalDataSizeMB' limit is reached, the buckets are rolled to frozen. As the default policy for frozen data is deletion, unintended data loss could occur.
• Splunkd ignores this setting on remote storage enabled indexes.
• Highest legal value is 4294967295
• Default: 500000

maxGlobalRawDataSizeMB =

• The maximum amount of cumulative raw data (in MB) allowed in a remote storage-enabled index.
• This setting is available for both standalone indexers and indexer clusters. In the case of indexer clusters, the raw data size is calculated as the total amount of raw data ingested for the index, across all peer nodes.
• When the amount of uncompressed raw data in an index exceeds the value of this setting, the bucket containing the oldest data is frozen.
• For example, assume that the setting is set to 500 and the indexer cluster has already ingested 400MB of raw data into the index, across all peer nodes. If the cluster ingests an additional amount of raw data greater than 100MB in size, the cluster freezes the oldest buckets, until the size of raw data reduces to less than or equal to 500MB.
• This value applies to warm and cold buckets. It does not apply to hot or thawed buckets.
• The maximum allowable value is 4294967295.
• Default: 0 (no limit to the amount of raw data in an index)

maxGlobalDataSizeMB =

• The maximum size, in megabytes, for all warm buckets in a SmartStore index. If the index was migrated from non-SmartStore to SmartStore this size also includes the size of all migrated cold buckets.
• This setting includes the sum of the size of all buckets that reside on remote storage, along with any buckets that have recently rolled from hot to warm on a peer node and are awaiting upload to remote storage.
• If the total size of the warm buckets in an index exceeds 'maxGlobalDataSizeMB', the oldest bucket in the index is frozen.
  • For example, assume that 'maxGlobalDataSizeMB' is set to 5000 for an index, and the index's warm buckets occupy 4800 MB. If a 750 MB hot bucket then rolls to warm, the index size now exceeds 'maxGlobalDataSizeMB', which triggers bucket freezing. The cluster freezes the oldest buckets on the index, until the total warm bucket size falls below 'maxGlobalDataSizeMB'.
• The size calculation for this setting applies on a per-index basis.
• The calculation applies across all peers in the cluster.
• The calculation includes only one copy of each bucket. If a duplicate copy of a bucket exists on a peer node, the size calculation does not include it.
  • For example, if the bucket exists on both remote storage and on a peer node's local cache, the calculation ignores the copy on local cache.
• The calculation includes only the size of the buckets themselves. It does not include the size of any associated files, such as report acceleration or data model acceleration summaries.
• The highest legal value is 4294967295 (4.2 petabytes.)
• Default: 0 (No limit to the space that the warm buckets on an index can occupy.)

rotatePeriodInSecs =

• Controls the service period (in seconds): how often splunkd performs certain housekeeping tasks. Among these tasks are:
  • Check if a new hot DB needs to be created.
  • Check if there are any cold DBs that should be frozen.
  • Check whether buckets need to be moved out of hot and cold DBs, due to respective size constraints (i.e., homePath.maxDataSizeMB and coldPath.maxDataSizeMB)
• This value becomes the default value of the 'rotatePeriodInSecs' setting for all volumes (see 'rotatePeriodInSecs' in the Volumes section)
• The highest legal value is 4294967295.
• Default: 60

frozenTimePeriodInSecs =

• The number of seconds after which indexed data rolls to frozen.
• If you do not specify a 'coldToFrozenScript', data is deleted when rolled to frozen.
• NOTE: Every event in a bucket must be older than 'frozenTimePeriodInSecs' seconds before the bucket rolls to frozen.
• The highest legal value is 4294967295.
• Default: 188697600 (6 years)

warmToColdScript =