Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

I need to set 12 indexes to have 30 to 60 days hot is the following correct?

$
0
0
Clients are saying they are only seeing 2 days worth of the logs. [name] homePath = volume:primary/name/db coldPath = volume:primary/name/colddb thawedPath = $SPLUNK_DB/name/thaweddb frozenTimePeriodInSecs = 15780000 maxWarmDBCount = 300 maxHotSpanSecs=7776000 maxHotBuckets = 3 maxTotalDataSizeMB = 75000 repFactor = auto

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>