When does a warm bucket roll over to a cold bucket?
When does a warm bucket roll over to a cold bucket?
A warm bucket rolls over to a cold bucket when the maximum number of warm buckets is reached. This is determined by the configuration parameter maxWarmDBCount. Once the maximum limit of warm buckets is reached, the indexer rolls the oldest warm bucket to a cold state.
D is the correct answer. https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes Once further conditions are met (for example, the index reaches some maximum number of warm buckets), the indexer begins to roll the warm buckets to cold, based on their age. It always selects the oldest warm bucket to roll to cold. Buckets continue to roll to cold as they age in this manner. Cold buckets reside in a different location from hot and warm buckets. You can configure the location so that cold buckets reside on cheaper storage.
It is D. From the System Admin course slides: Warm buckets roll to cold when: The Home Path maximum size is reached (not the bucket size as in the wrong answer) or the maximum warm bucket count (maxWarmDBCount) is reached
D - From warm to cold; once the number of maxWarmDBCount is reached, the older will be rolled. https://wiki.splunk.com/Deploy:BucketRotationAndRetention
Is that answer correct?
D. While the order of roll is based on age, warm buckets will not roll to cold just because of age. A max limit number of buckets need to be reached in order to trigger the rolling.
Agreed D. Quoting the Splunk Wiki reference URL https://wiki.splunk.com/Deploy:BucketRotationAndRetention "Bucket Stages. A bucket rolls from one stage to another depending on certain conditions: Hot -> Warm -> Cold -> Frozen (-> Thawed). From hot to warm if its size reaches a limit 'maxDataSize' or its lifetime is older than 'maxHotSpanSecs', or by using a manual command to roll the buckets. From warm to cold; once the number of maxWarmDBCount is reached, the older will be rolled."
Answer D maxWarmDBCount Determines rolling behavior, warm to cold. The maximum number of warm buckets. When the maximum is reached, warm buckets begin rolling to cold. https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Configureindexstorage
The answer is also A Hot buckets also roll to warm automatically when the indexer is restarted
the question is a little bit tricky, thats can be size or age reached to roll to cold
B i think. As buckets age, they "roll" from one state to the next. When data is first indexed, it gets written to a hot bucket. Hot buckets are buckets that are actively being written to. An index can have several hot buckets open at a time. Hot buckets are also searchable. When certain conditions are met (for example, the hot bucket reaches a certain size or the indexer gets restarted), the hot bucket becomes a warm bucket ("rolls to warm"), and a new hot bucket is created in its place. The warm bucket is renamed but it remains in the same location as when it was a hot bucket. Warm buckets are searchable, but they are not actively written to. There can be a large number of warm buckets.
I could be D .
D is correct
Warm bucket count (default 300), once its reached, it switches to cold. Answer D
D is the answer. maxWarmDBCount reaches 300. https://docs.splunk.com/Documentation/Splunk/8.1.2/Indexer/Configureindexstorage
Option D maxWarmDBCount : Determines rolling behavior, warm to cold. The maximum number of warm buckets. When the maximum is reached, warm buckets begin rolling to cold