Hi,
We are are setting up our indexes to all have a retention policy of 180 total days. 10 days in hot/warm and 170 in cold.
Below is a sample stanza that we plan to setup for each index. Can we get some suggestions if this will fit our needs or if there's a better approach?
[ai_gomez_1]
repFactor=auto
homePath=/opt/splunkdb/ai_gomez_1/db
coldPath=/mnt2/splunkdb-cold/ai_gomez_1/colddb
thawedPath=/mnt2/splunkdb-cold/ai_gomez_1/thaweddb
# Roll hot buckets to warm (after 7-days)
maxHotSpanSecs=604800
# Roll warm buckets to cold when warm bucket count reaches this value (default=300)
maxWarmDBCount=10
# (Delete data) roll warm/cold buckets to frozen bucket (after 6-months)
frozenTimePeriodInSecs=15552000
# Max size of index in MB, max value: 4294967295
maxTotalDataSizeMB=4294967295
Thanks
↧