SPLK-1003 · Question #78
When does a warm bucket roll over to a cold bucket?
The correct answer is D. When the maximum number of warm buckets is reached.. In Splunk's data lifecycle, buckets progress through stages: Hot → Warm → Cold → Frozen. A warm bucket rolls over to cold when the maximum number of warm buckets (maxWarmDBCount in indexes.conf) has been reached. When a new warm bucket needs to be created and doing so would excee
Question
When does a warm bucket roll over to a cold bucket?
Options
- AWhen Splunk is restarted.
- BWhen the maximum warm bucket age has been reached.
- CWhen the maximum warm bucket size has been reached.
- DWhen the maximum number of warm buckets is reached.
How the community answered
(54 responses)- A2% (1)
- C4% (2)
- D94% (51)
Explanation
In Splunk's data lifecycle, buckets progress through stages: Hot → Warm → Cold → Frozen. A warm bucket rolls over to cold when the maximum number of warm buckets (maxWarmDBCount in indexes.conf) has been reached. When a new warm bucket needs to be created and doing so would exceed the limit, Splunk moves the oldest warm bucket to the cold tier to make room. A warm bucket does NOT roll to cold based on age or size-those thresholds govern the hot-to-warm transition or frozen archival. Restarting Splunk does not trigger a rollover.
Topics
Community Discussion
No community discussion yet for this question.