cerner_splunk icon indicating copy to clipboard operation
cerner_splunk copied to clipboard

Adjust bucket size with index size

Open gravesb opened this issue 7 years ago • 0 comments

In some environments we're seeing messages like:

11-08-2016 15:48:36.772 -0600 WARN  IndexConfig - Max bucket size is larger than the index size limit. Please check your index configuration. idx=my-idx; bucket size in MB (from maxDataSize) 750, maxTotalDataSizeMB=133

This is potentially problematic as that means each of these indexes could only have one bucket (on each indexer)... and rolling and making a new bucket would likely wipe out the index completely.

We currently set maxDataSize = auto = 750MB automatically... we should consider auto_high_volume (10GB) for some indexes, but there's of course a range of tuning in between to figure out as well.

gravesb avatar Jan 07 '19 22:01 gravesb