Option D
maxWarmDBCount : Determines rolling behavior, warm to cold.
The maximum number of warm buckets. When the maximum is reached, warm buckets begin rolling to cold
Answer D
maxWarmDBCount Determines rolling behavior, warm to cold. The maximum number of warm buckets. When the maximum is reached, warm buckets begin rolling to cold.
https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Configureindexstorage
D. While the order of roll is based on age, warm buckets will not roll to cold just because of age. A max limit number of buckets need to be reached in order to trigger the rolling.
Agreed D. Quoting the Splunk Wiki reference URL https://wiki.splunk.com/Deploy:BucketRotationAndRetention
"Bucket Stages. A bucket rolls from one stage to another depending on certain conditions: Hot -> Warm -> Cold -> Frozen (-> Thawed). From hot to warm if its size reaches a limit 'maxDataSize' or its lifetime is older than 'maxHotSpanSecs', or by using a manual command to roll the buckets. From warm to cold; once the number of maxWarmDBCount is reached, the older will be rolled."
D - From warm to cold; once the number of maxWarmDBCount is reached, the older will be rolled.
https://wiki.splunk.com/Deploy:BucketRotationAndRetention
It is D. From the System Admin course slides:
Warm buckets roll to cold when: The Home Path maximum size is reached (not the bucket size as in the wrong answer) or the maximum warm bucket count (maxWarmDBCount) is reached
B i think.
As buckets age, they "roll" from one state to the next. When data is first indexed, it gets written to a hot bucket. Hot buckets are buckets that are actively being written to. An index can have several hot buckets open at a time. Hot buckets are also searchable.
When certain conditions are met (for example, the hot bucket reaches a certain size or the indexer gets restarted), the hot bucket becomes a warm bucket ("rolls to warm"), and a new hot bucket is created in its place. The warm bucket is renamed but it remains in the same location as when it was a hot bucket. Warm buckets are searchable, but they are not actively written to. There can be a large number of warm buckets.
D is the correct answer.
https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes
Once further conditions are met (for example, the index reaches some maximum number of warm buckets), the indexer begins to roll the warm buckets to cold, based on their age. It always selects the oldest warm bucket to roll to cold. Buckets continue to roll to cold as they age in this manner. Cold buckets reside in a different location from hot and warm buckets. You can configure the location so that cold buckets reside on cheaper storage.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
toney_mu
8 months, 3 weeks agomngesha
8 months, 3 weeks agodenominator
1 year, 4 months agoBlueRoselia
1 year, 8 months agoBlueRoselia
1 year, 8 months agoloky0
2 years, 2 months agoucsdmiami2020
2 years agojm130106
2 years, 2 months agoMariuszSem
2 years, 3 months agoAngusBlack
2 years, 4 months agongum
2 years, 6 months agongum
2 years, 6 months agothomass
2 years, 7 months agohwangho
2 years, 10 months agonewrose
2 years, 11 months ago