The majority of my indexes are using the default maxWarmDBCount setting of 300. I have a handful of indexes that I have maxDataSize set to auto_high_volume. All other bucket rolling settings aside, most of my auto_high_volume indexes have yet to reach the maxWarmDBCount of 300, however, I'm occasionally seeing warm buckets in these indexes being rolled to cold with the accompanying splunkd.log message: "INFO BucketMover - idx=_myindex_ Moving bucket='_bucketid_' because maximum number of warm databases exceeded, starting warm_to_cold: from='_warmvolume_' to='_coldvolume_'"
Although I have other measures in place and _could_ increase the maxWarmDBCount over 300 I feel it's completely unnecessary as I'm barely scratching 200 buckets on these indexes at any given time.
I do have my indexes restricted by maximum size on disk per index but I wouldn't have thought I'd see the message "because maximum number of warm databases exceeded" if the buckets were rolling based on index size constraints.
Does anyone have any idea why these warm buckets might be rolling prematurely to cold based on maxWarmDBCount even though the limit has yet to be reached? I'm seeing this occur way more frequently than I think it should be based on the maxWarmDBCount limit set on the indexes.
↧