com.splunk
Class Index

java.lang.Object
  com.splunk.Resource
      com.splunk.Entity
          com.splunk.Index

All Implemented Interfaces:

java.util.Map<java.lang.String,java.lang.Object>

public class Index
extends Entity

The Index class represents an index.

Nested Class Summary

Nested classes/interfaces inherited from interface java.util.Map

java.util.Map.Entry<K,V>

Field Summary

Fields inherited from class com.splunk.Entity

toUpdate

Fields inherited from class com.splunk.Resource

actions, path, refreshArgs, service, title

Method Summary

java.net.Socket	attach() Creates a writable socket to this index.
java.net.Socket	attach(Args args) Creates a writable socket to this index.
void	attachWith(ReceiverBehavior behavior) Writes events to this index, reusing the connection.
Index	clean(int maxSeconds) Cleans this index, which removes all events from it.
boolean	getAssureUTF8() Indicates whether the data retrieved from this index has been UTF8-encoded.
java.lang.String	getBlockSignatureDatabase() Returns the block signature database for this index.
int	getBlockSignSize() Returns the number of events that make up a block for block signatures.
int	getBloomfilterTotalSizeKB() Returns the total size of all bloom filter files.
java.lang.String	getBucketRebuildMemoryHint() Returns the suggested size of the .tsidx file for the bucket rebuild process.
java.lang.String	getColdPath() Returns the absolute file path to the cold database for this index.
java.lang.String	getColdPathExpanded() Returns the expanded absolute file path to the cold database for this index.
java.lang.String	getColdToFrozenDir() Returns the frozen archive destination path for this index.
java.lang.String	getColdToFrozenScript() Returns the path to the archiving script.
boolean	getCompressRawdata() Deprecated. Splunk always compresses raw data.
int	getCurrentDBSizeMB() Returns the current size of this index.
java.lang.String	getDefaultDatabase() Return the default index name of the Splunk instance.
boolean	getEnableOnlineBucketRepair() Returns whether asynchronous "online fsck" bucket repair is enabled.
boolean	getEnableRealtimeSearch() Indicates whether real-time search is enabled for this index.
int	getFrozenTimePeriodInSecs() Returns the maximum age for a bucket, after which the data in this index rolls to frozen.
java.lang.String	getHomePath() Returns the absolute path to both hot and warm buckets for this index.
java.lang.String	getHomePathExpanded() Returns the expanded absolute path to both hot and warm buckets for this index.
java.lang.String	getIndexThreads() Returns the index thread for this index.
java.lang.String	getLastInitTime() Returns the last initialization time for this index.
java.lang.String	getMaxBloomBackfillBucketAge() Returns the time that indicates a bucket age.
int	getMaxConcurrentOptimizes() Returns the maximum number of concurrent optimize processes that can run against a hot bucket for this index.
java.lang.String	getMaxDataSize() Returns the maximum data size before triggering a roll from hot to warm buckets for this index.
int	getMaxHotBuckets() Returns the maximum number of hot buckets that can exist for this index.
int	getMaxHotIdleSecs() Returns the maximum lifetime of a hot bucket for this index.
int	getMaxHotSpanSecs() Returns the upper bound of the target maximum timespan of hot and warm buckets for this index.
int	getMaxMemMB() Returns the amount of memory to allocate for buffering a single .tsidx file into memory before flushing to disk.
int	getMaxMetaEntries() Returns the maximum number of unique lines that are allowed in a bucket's .data files for this index.
int	getMaxRunningProcessGroups() Returns the maximum number of concurrent helper processes for this index.
java.util.Date	getMaxTime() Returns the maximum time attribute for this index.
int	getMaxTimeUnreplicatedNoAcks() Returns the upper limit, in seconds, for how long an event can sit in a raw slice.
int	getMaxTimeUnreplicatedWithAcks() Returns the upper limit, in seconds, for how long an event can sit unacknowledged in a raw slice.
int	getMaxTotalDataSizeMB() Returns the maximum size of this index.
int	getMaxWarmDBCount() Returns the maximum number of warm buckets for this index.
java.lang.String	getMemPoolMB() Returns the memory pool for this index.
java.lang.String	getMinRawFileSyncSecs() Returns the frequency at which Splunkd forces a filesystem sync while compressing journal slices for this index.
java.util.Date	getMinTime() Returns the minimum time attribute for this index.
int	getNumBloomfilters() Returns the number of bloom filters created for this index.
int	getNumHotBuckets() Returns the number of hot buckets that were created for this index.
int	getNumWarmBuckets() Returns the number of warm buckets created for this index.
int	getPartialServiceMetaPeriod() Returns the frequency at which metadata is for partially synced (synced in-place) for this index.
int	getQuarantineFutureSecs() Returns the future event-time quarantine for this index.
int	getQuarantinePastSecs() Returns the past event-time quarantine for this index.
int	getRawChunkSizeBytes() Returns the target uncompressed size of individual raw slices in the rawdata journal for this index.
int	getRotatePeriodInSecs() Returns the frequency to check for the need to create a new hot bucket and the need to roll or freeze any warm or cold buckets for this index.
int	getServiceMetaPeriod() Returns the frequency at which metadata is synced to disk for this index.
java.lang.String	getSuppressBannerList() Returns a list of indexes that suppress "index missing" messages.
int	getSync() Returns the number of events that trigger the indexer to sync events.
boolean	getSyncMeta() Indicates whether the sync operation is called before the file descriptor is closed on metadata updates.
java.lang.String	getThawedPath() Returns the absolute path to the thawed index for this index.
java.lang.String	getThawedPathExpanded() Returns the expanded absolute path to the thawed index for this index.
int	getThrottleCheckPeriod() Returns the frequency at which Splunk checks for an index throttling condition.
int	getTotalEventCount() Returns the total event count for this index.
boolean	isInternal() Indicates whether this index is an internal index.
void	rollHotBuckets() Performs rolling hot buckets for this index.
void	setAssureUTF8(boolean assure) Sets whether the data retrieved from this index is UTF8-encoded.
void	setBlockSignSize(int value) Sets the number of events that make up a block for block signatures.
void	setBucketRebuildMemoryHint(java.lang.String value) Sets the suggested size of the .tsidx file for the bucket rebuild process.
void	setColdToFrozenDir(java.lang.String destination) Sets the destination path for the frozen archive, where Splunk automatically puts frozen buckets.
void	setColdToFrozenScript(java.lang.String script) Sets the path to the archiving script.
void	setEnableOnlineBucketRepair(boolean value) Sets whether asynchronous "online fsck" bucket repair is enabled.
void	setFrozenTimePeriodInSecs(int seconds) Sets the maximum age for a bucket, after which the data in this index rolls to frozen.
void	setMaxBloomBackfillBucketAge(java.lang.String time) Sets the time that indicates a bucket age.
void	setMaxConcurrentOptimizes(int processes) Sets the number of concurrent optimize processes that can run against a hot bucket for this index.
void	setMaxDataSize(java.lang.String size) Sets the maximum data size before triggering a roll from hot to warm buckets for this index.
void	setMaxHotBuckets(int size) Sets the maximum number of hot buckets that can exist per index.
void	setMaxHotIdleSecs(int seconds) Sets the maximum lifetime of a hot bucket for this index.
void	setMaxHotSpanSecs(int seconds) Sets the upper bound of the target maximum timespan of hot and warm buckets for this index.
void	setMaxMemMB(int memory) Sets the amount of memory allocated for buffering a single .tsidx file before flushing to disk.
void	setMaxMetaEntries(int entries) Sets the maximum number of unique lines in .data files in a bucket, which may help to reduce memory consumption.
void	setMaxTimeUnreplicatedNoAcks(int value) Sets the upper limit for how long an event can sit in a raw slice.
void	setMaxTimeUnreplicatedWithAcks(int value) Sets the upper limit for how long an event can sit unacknowledged in a raw slice.
void	setMaxTotalDataSizeMB(int size) Sets the maximum size for this index.
void	setMaxWarmDBCount(int buckets) Sets the maximum number of warm buckets.
void	setMinRawFileSyncSecs(java.lang.String frequency) Sets the frequency at which Splunkd forces a file system sync while compressing journal slices for this index.
void	setPartialServiceMetaPeriod(int frequency) Sets the frequency at which metadata is for partially synced (synced in-place) for this index.
void	setQuarantineFutureSecs(int window) Sets a quarantine for events that are timestamped in the future to help prevent main hot buckets from being polluted with fringe events.
void	setQuarantinePastSecs(int window) Sets a quarantine for events that are timestamped in the past to help prevent main hot buckets from being polluted with fringe events.
void	setRawChunkSizeBytes(int size) Sets the target uncompressed size of individual raw slices in the rawdata journal for this index.
void	setRotatePeriodInSecs(int frequency) Sets the frequency to check for the need to create a new hot bucket and the need to roll or freeze any warm or cold buckets for this index.
void	setServiceMetaPeriod(int frequency) Sets the frequency at which metadata is synced to disk for this index.
void	setSyncMeta(boolean sync) Sets whether the sync operation is called before the file descriptor is closed on metadata updates.
void	setThrottleCheckPeriod(int frequency) Sets the frequency at which Splunk checks for an index throttling condition.
void	submit(Args args, java.lang.String data) Submits an event to this index through an HTTP POST request.
void	submit(java.lang.String data) Submits an event to this index through an HTTP POST request.
void	upload(java.lang.String filename) Uploads a file to this index as an event stream.

Methods inherited from class com.splunk.Entity

actionPath, clear, containsKey, containsValue, disable, enable, entrySet, get, getMetadata, isDisabled, isEmpty, isNameChangeAllowed, keySet, put, putAll, refresh, remove, remove, size, update, update, validate, values

Methods inherited from class com.splunk.Resource

getName, getPath, getService, getTitle, invalidate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.Map

equals, hashCode

Method Detail

attach

public java.net.Socket attach()
                       throws java.io.IOException

Creates a writable socket to this index.

Returns:

The writable socket.

Throws:

java.io.IOException

attachWith

public void attachWith(ReceiverBehavior behavior)
                throws java.io.IOException

Writes events to this index, reusing the connection. This method passes an output stream connected to the index to the run method of the ReceiverBehavior object, then handles setting up and tearing down the socket.

For an example of how to use this method, see How to get data into Splunk on dev.splunk.com.

Parameters:

behavior - The body of a try block as an anonymous implementation of the ReceiverBehavior interface.

Throws:

java.io.IOException

attach

public java.net.Socket attach(Args args)
                       throws java.io.IOException

Creates a writable socket to this index.

Parameters:

args - Optional arguments for this stream. Valid parameters are: "host", "host_regex", "source", and "sourcetype".

Returns:

The socket.

Throws:

java.io.IOException

clean

public Index clean(int maxSeconds)

Cleans this index, which removes all events from it.

Parameters:

maxSeconds - The maximum number of seconds to wait before returning. A value of -1 means to wait forever.

Returns:

This index.

Throws:

SplunkException - If cleaning timed out or if the thread was interrupted.

getAssureUTF8

public boolean getAssureUTF8()

Indicates whether the data retrieved from this index has been UTF8-encoded.

Returns:

true if the retrieved data is in UTF8, false if not.

getBlockSignatureDatabase

public java.lang.String getBlockSignatureDatabase()

Returns the block signature database for this index.

Returns:

The block signature database.

getBlockSignSize

public int getBlockSignSize()

Returns the number of events that make up a block for block signatures.

Returns:

The block sign size. A value of 0 means block signing has been disabled.

getBloomfilterTotalSizeKB

public int getBloomfilterTotalSizeKB()

Returns the total size of all bloom filter files.

Returns:

The total size of all bloom filter files, in KB.

getBucketRebuildMemoryHint

public java.lang.String getBucketRebuildMemoryHint()

Returns the suggested size of the .tsidx file for the bucket rebuild process. Valid values are: "auto", a positive integer, or a positive integer followed by "KB", "MB", or "GB".

Returns:

The suggested size of the .tsidx file for the bucket rebuild process.

getColdPath

public java.lang.String getColdPath()

Returns the absolute file path to the cold database for this index. This value may contain shell expansion terms.

Returns:

The absolute file path to the cold database, or null if not specified.

getColdPathExpanded

public java.lang.String getColdPathExpanded()

Returns the expanded absolute file path to the cold database for this index.

Returns:

The expanded absolute file path to the cold database, or null if not specified.

getColdToFrozenDir

public java.lang.String getColdToFrozenDir()

Returns the frozen archive destination path for this index.

Returns:

The frozen archive destination path, or null if not specified.

getColdToFrozenScript

public java.lang.String getColdToFrozenScript()

Returns the path to the archiving script.

For more info about archiving scripts, see the POST data/indexes endpoint in the REST API documentation.

Returns:

The archiving script, or null if not specified.

See Also:

getColdToFrozenDir()

getCompressRawdata

public boolean getCompressRawdata()

Deprecated. Splunk always compresses raw data.

Indicates whether raw data is compressed.

Returns:

true if raw data is compressed, false if not.

getCurrentDBSizeMB

public int getCurrentDBSizeMB()

Returns the current size of this index.

Returns:

The current size of the index, in MB.

getDefaultDatabase

public java.lang.String getDefaultDatabase()

Return the default index name of the Splunk instance.

Returns:

The default index name.

getEnableOnlineBucketRepair

public boolean getEnableOnlineBucketRepair()

Returns whether asynchronous "online fsck" bucket repair is enabled.

When this feature is enabled, you don't have to wait for buckets to be repaired before starting Splunk, but you might notice a slight degradation in performance as a result.

Returns:

true if bucket repair is enabled, false if not.

getEnableRealtimeSearch

public boolean getEnableRealtimeSearch()

Indicates whether real-time search is enabled for this index.

Returns:

true if real-time search is enabled, false if not.

getFrozenTimePeriodInSecs

public int getFrozenTimePeriodInSecs()

Returns the maximum age for a bucket, after which the data in this index rolls to frozen. If archiving is necessary for frozen data, see the coldToFrozen attributes.

Returns:

The maximum age, in seconds, after which data rolls to frozen.

getHomePath

public java.lang.String getHomePath()

Returns the absolute path to both hot and warm buckets for this index. This value may contain shell expansion terms.

Returns:

This index's absolute path to both hot and warm buckets, or null if not specified.

getHomePathExpanded

public java.lang.String getHomePathExpanded()

Returns the expanded absolute path to both hot and warm buckets for this index.

Returns:

The expanded absolute path to both hot and warm buckets, or null if not specified.

getIndexThreads

public java.lang.String getIndexThreads()

Returns the index thread for this index.

Returns:

The index thread.

getLastInitTime

public java.lang.String getLastInitTime()

Returns the last initialization time for this index.

Returns:

The last initialization time, or null if not specified.

getMaxBloomBackfillBucketAge

public java.lang.String getMaxBloomBackfillBucketAge()

Returns the time that indicates a bucket age. When a warm or cold bucket is older than this, Splunk does not create or rebuild its bloomfilter. The valid format is number followed by a time unit ("s", "m", "h", or "d"). For example, "30d" for 30 days.

getMaxConcurrentOptimizes

public int getMaxConcurrentOptimizes()

Returns the maximum number of concurrent optimize processes that can run against a hot bucket for this index.

Returns:

The maximum number of concurrent optimize processes.

getMaxDataSize

public java.lang.String getMaxDataSize()

Returns the maximum data size before triggering a roll from hot to warm buckets for this index.

Returns:

The maximum data size, in MB, or "auto" (which means 750MB), or "auto_high_volume" (which means 10GB on a 64-bit system, or 1GB on a 32-bit system).

See Also:

setMaxDataSize(java.lang.String)

getMaxHotBuckets

public int getMaxHotBuckets()

Returns the maximum number of hot buckets that can exist for this index.

Returns:

The maximum number of hot buckets.

getMaxHotIdleSecs

public int getMaxHotIdleSecs()

Returns the maximum lifetime of a hot bucket for this index. If a hot bucket exceeds this value, Splunk rolls it to warm. A value of 0 means an infinite lifetime.

Returns:

The hot bucket's maximum lifetime, in seconds.

getMaxHotSpanSecs

public int getMaxHotSpanSecs()

Returns the upper bound of the target maximum timespan of hot and warm buckets for this index.

Returns:

The upper bound of the target maximum timespan, in seconds.

getMaxMemMB

public int getMaxMemMB()

Returns the amount of memory to allocate for buffering a single .tsidx file into memory before flushing to disk.

Returns:

The amount of memory, in MB.

getMaxMetaEntries

public int getMaxMetaEntries()

Returns the maximum number of unique lines that are allowed in a bucket's .data files for this index. A value of 0 means infinite lines.

Returns:

The maximum number of unique lines.

getMaxRunningProcessGroups

public int getMaxRunningProcessGroups()

Returns the maximum number of concurrent helper processes for this index.

Returns:

The maximum number of concurrent helper processes.

getMaxTime

public java.util.Date getMaxTime()

Returns the maximum time attribute for this index.

Returns:

The maximum time attribute, or null if not specified.

getMaxTotalDataSizeMB

public int getMaxTotalDataSizeMB()

Returns the maximum size of this index. If an index grows larger than this value, the oldest data is frozen.

Returns:

The maximum index size, in MB.

getMaxTimeUnreplicatedNoAcks

public int getMaxTimeUnreplicatedNoAcks()

Returns the upper limit, in seconds, for how long an event can sit in a raw slice. This value applies only when replication is enabled for this index, and is ignored otherwise.
If there are any acknowledged events sharing this raw slice, the MaxTimeUnreplicatedWithAcksparamater applies instead.

See Also:

getMaxTimeUnreplicatedWithAcks()

getMaxTimeUnreplicatedWithAcks

public int getMaxTimeUnreplicatedWithAcks()

Returns the upper limit, in seconds, for how long an event can sit unacknowledged in a raw slice. This value only applies when indexer acknowledgement is enabled on forwarders and replication is enabled with clustering.

getMaxWarmDBCount

public int getMaxWarmDBCount()

Returns the maximum number of warm buckets for this index. If this value is exceeded, the warm buckets with the lowest value for their latest times are moved to cold.

Returns:

The maximum number of warm buckets.

getMemPoolMB

public java.lang.String getMemPoolMB()

Returns the memory pool for this index.

Returns:

The memory pool, in MB or "auto".

getMinRawFileSyncSecs

public java.lang.String getMinRawFileSyncSecs()

Returns the frequency at which Splunkd forces a filesystem sync while compressing journal slices for this index.

A value of "disable" disables this feature completely, while a value of 0 forces a file-system sync after completing compression of every journal slice.

Returns:

The file-system sync frequency, as an integer or "disable".

getMinTime

public java.util.Date getMinTime()

Returns the minimum time attribute for this index.

Returns:

The minimum time attribute, or null if not specified.

getNumHotBuckets

public int getNumHotBuckets()

Returns the number of hot buckets that were created for this index.

Returns:

The number of hot buckets.

getNumWarmBuckets

public int getNumWarmBuckets()

Returns the number of warm buckets created for this index.

Returns:

The number of warm buckets.

getNumBloomfilters

public int getNumBloomfilters()

Returns the number of bloom filters created for this index.

Returns:

The number of bloom filters.

getPartialServiceMetaPeriod

public int getPartialServiceMetaPeriod()

Returns the frequency at which metadata is for partially synced (synced in-place) for this index. A value of 0 disables partial syncing, so metadata is only synced on the ServiceMetaPeriod interval.

Returns:

The metadata sync interval, in seconds.

See Also:

getServiceMetaPeriod(), setServiceMetaPeriod(int)

getQuarantineFutureSecs

public int getQuarantineFutureSecs()

Returns the future event-time quarantine for this index. Events that are newer than now plus this value are quarantined.

Returns:

The future event-time quarantine, in seconds.

getQuarantinePastSecs

public int getQuarantinePastSecs()

Returns the past event-time quarantine for this index. Events that are older than now minus this value are quarantined.

Returns:

The past event-time quarantine, in seconds.

getRawChunkSizeBytes

public int getRawChunkSizeBytes()

Returns the target uncompressed size of individual raw slices in the rawdata journal for this index.

Returns:

The target uncompressed size, in bytes.

getRotatePeriodInSecs

public int getRotatePeriodInSecs()

Returns the frequency to check for the need to create a new hot bucket and the need to roll or freeze any warm or cold buckets for this index.

Returns:

The check frequency, in seconds.

getServiceMetaPeriod

public int getServiceMetaPeriod()

Returns the frequency at which metadata is synced to disk for this index.

Returns:

The meta data sync frequency, in seconds.

getSuppressBannerList

public java.lang.String getSuppressBannerList()

Returns a list of indexes that suppress "index missing" messages.

Returns:

A comma-separated list of indexes.

getSync

public int getSync()

Returns the number of events that trigger the indexer to sync events. This value is global, not a per-index value.

Returns:

The number of events that trigger the indexer to sync events.

getSyncMeta

public boolean getSyncMeta()

Indicates whether the sync operation is called before the file descriptor is closed on metadata updates.

Returns:

true if the sync operation is called before the file descriptor is closed on metadata updates, false if not.

getThawedPath

public java.lang.String getThawedPath()

Returns the absolute path to the thawed index for this index. This value may contain shell expansion terms.

Returns:

The absolute path to the thawed index, or null if not specified.

getThawedPathExpanded

public java.lang.String getThawedPathExpanded()

Returns the expanded absolute path to the thawed index for this index.

Returns:

The expanded absolute path to the thawed index, or null if not specified.

getThrottleCheckPeriod

public int getThrottleCheckPeriod()

Returns the frequency at which Splunk checks for an index throttling condition.

Returns:

The frequency of the throttling check, in seconds.

getTotalEventCount

public int getTotalEventCount()

Returns the total event count for this index.

Returns:

The total event count.

isInternal

public boolean isInternal()

Indicates whether this index is an internal index.

Returns:

true if this index is an internal index, false if not.

rollHotBuckets

public void rollHotBuckets()

Performs rolling hot buckets for this index.

setAssureUTF8

public void setAssureUTF8(boolean assure)

Sets whether the data retrieved from this index is UTF8-encoded.

Note: Indexing performance degrades when this parameter is set to true. In Splunk 5.0 and later, this is a global property and cannot be set on a per-index basis.

Parameters:

assure - true to ensure UTF8 encoding, false if not.

setBlockSignSize

public void setBlockSignSize(int value)

Sets the number of events that make up a block for block signatures. A value of 100 is recommended. A value of 0 disables block signing for this index.

Parameters:

value - The event count for block signing.

setBucketRebuildMemoryHint

public void setBucketRebuildMemoryHint(java.lang.String value)

Sets the suggested size of the .tsidx file for the bucket rebuild process. Valid values are: "auto", a positive integer, or a positive integer followed by "KB", "MB", or "GB".

Parameters:

value - The suggested size of the .tsidx file for the bucket rebuild process.

setColdToFrozenDir

public void setColdToFrozenDir(java.lang.String destination)

Sets the destination path for the frozen archive, where Splunk automatically puts frozen buckets. The bucket freezing policy is as follows:

• New-style buckets (4.2 and later): All files are removed except the raw data. To thaw frozen buckets, run Splunk rebuild <bucket dir> on the bucket, then move the buckets to the thawed directory.
• Old-style buckets (4.1 and earlier): gzip all the .data and .tsidx files. To thaw frozen buckets, gunzip the zipped files and move the buckets to the thawed directory.

If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence.

Parameters:

destination - The destination path for the frozen archive.

See Also:

setColdToFrozenScript(java.lang.String), getColdToFrozenScript()

setColdToFrozenScript

public void setColdToFrozenScript(java.lang.String script)

Sets the path to the archiving script.

For more info about archiving scripts, see the POST data/indexes endpoint in the REST API documentation.

Parameters:

script - The path to the archiving script.

See Also:

setColdToFrozenDir(java.lang.String), getColdToFrozenDir()

setEnableOnlineBucketRepair

public void setEnableOnlineBucketRepair(boolean value)

Sets whether asynchronous "online fsck" bucket repair is enabled.

When this feature is enabled, you don't have to wait for buckets to be repaired before starting Splunk, but you might notice a slight degradation in performance as a result.

Parameters:

value - true to enable online bucket repair, false if not.

setFrozenTimePeriodInSecs

public void setFrozenTimePeriodInSecs(int seconds)

Sets the maximum age for a bucket, after which the data in this index rolls to frozen. Freezing data removes it from the index. To archive data, see coldToFrozenDir and coldToFrozenScript.

Parameters:

seconds - The time, in seconds, after which indexed data rolls to frozen.

See Also:

setColdToFrozenDir(java.lang.String), setColdToFrozenScript(java.lang.String)

setMaxBloomBackfillBucketAge

public void setMaxBloomBackfillBucketAge(java.lang.String time)

Sets the time that indicates a bucket age. When a warm or cold bucket is older than this, Splunk does not create or rebuild its bloomfilter. The valid format is number followed by a time unit ("s", "m", "h", or "d"). For example, "30d" for 30 days.

Parameters:

time - The time that indicates a bucket age.

setMaxConcurrentOptimizes

public void setMaxConcurrentOptimizes(int processes)

Sets the number of concurrent optimize processes that can run against a hot bucket for this index.

Parameters:

processes - The number of concurrent optimize processes.

setMaxDataSize

public void setMaxDataSize(java.lang.String size)

Sets the maximum data size before triggering a roll from hot to warm buckets for this index. You can also specify a value to let Splunk autotune this parameter: use "auto_high_volume" for high-volume indexes (such as the main index, or one that gets over 10GB of data per day); otherwise, use "auto".

Parameters:

size - The size in MB, or an autotune string.

See Also:

getMaxDataSize()

setMaxHotBuckets

public void setMaxHotBuckets(int size)

Sets the maximum number of hot buckets that can exist per index.

When maxHotBuckets is exceeded, Splunk rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of MaxHotIdleSecs, which can also cause hot buckets to roll.

Parameters:

size - The maximum number of hot buckets per index.

See Also:

setMaxHotIdleSecs(int), getMaxHotIdleSecs()

setMaxHotIdleSecs

public void setMaxHotIdleSecs(int seconds)

Sets the maximum lifetime of a hot bucket for this index.

If a hot bucket exceeds this value, Splunk rolls it to warm. This setting operates independently of MaxHotBuckets, which can also cause hot buckets to roll.

Parameters:

seconds - The hot bucket's maximum lifetime, in seconds. A value of 0 means an infinite lifetime.

See Also:

setMaxHotBuckets(int), getMaxHotBuckets()

setMaxHotSpanSecs

public void setMaxHotSpanSecs(int seconds)

Sets the upper bound of the target maximum timespan of hot and warm buckets for this index.

Note: If you set this too small, you can get an explosion of hot and warm buckets in the file system. The system sets a lower bound implicitly for this parameter at 3600, but this advanced parameter should be set with care and understanding of the characteristics of your data.

Parameters:

seconds - The upper bound of the target maximum timespan, in seconds.

setMaxMemMB

public void setMaxMemMB(int memory)

Sets the amount of memory allocated for buffering a single .tsidx file before flushing to disk.

Parameters:

memory - The amount of memory, in MB.

setMaxMetaEntries

public void setMaxMetaEntries(int entries)

Sets the maximum number of unique lines in .data files in a bucket, which may help to reduce memory consumption.

If this value is exceeded, a hot bucket is rolled to prevent a further increase. If your buckets are rolling due to Strings.data hitting this limit, the culprit might be the "punct" field in your data. If you don't use that field, it might be better to just disable this (see the props.conf.spec in $SPLUNK_HOME/etc/system/README).

Parameters:

entries - The maximum number of unique lines. A value of 0 means infinite lines.

setMaxTimeUnreplicatedNoAcks

public void setMaxTimeUnreplicatedNoAcks(int value)

Sets the upper limit for how long an event can sit in a raw slice. This value applies only when replication is enabled for this index, and is ignored otherwise.
If there are any acknowledged events sharing this raw slice, the MaxTimeUnreplicatedWithAcksparamater applies instead.

Parameters:

value - The upper limit, in seconds. A value of 0 disables this setting.

setMaxTimeUnreplicatedWithAcks

public void setMaxTimeUnreplicatedWithAcks(int value)

Sets the upper limit for how long an event can sit unacknowledged in a raw slice. This value only applies when indexer acknowledgement is enabled on forwarders and replication is enabled with clustering.

This number should not exceed the acknowledgement timeout configured on any forwarder.

Parameters:

value - The upper limit, in seconds. A value of 0 disables this setting (not recommended).

setMaxTotalDataSizeMB

public void setMaxTotalDataSizeMB(int size)

Sets the maximum size for this index. If an index grows larger than this value, the oldest data is frozen.

Parameters:

size - The maximum index size, in MB.

setMaxWarmDBCount

public void setMaxWarmDBCount(int buckets)

Sets the maximum number of warm buckets. If this number is exceeded, the warm buckets with the lowest value for their latest times will be moved to cold.

Parameters:

buckets - The maximum number of warm buckets.

setMinRawFileSyncSecs

public void setMinRawFileSyncSecs(java.lang.String frequency)

Sets the frequency at which Splunkd forces a file system sync while compressing journal slices for this index. A value of "disable" disables this feature completely, while a value of 0 forces a file-system sync after completing compression of every journal slice.

Parameters:

frequency - The file-system sync frequency, as an integer or "disable".

setPartialServiceMetaPeriod

public void setPartialServiceMetaPeriod(int frequency)

Sets the frequency at which metadata is for partially synced (synced in-place) for this index. A value of 0 disables partial syncing, so metadata is only synced on the ServiceMetaPeriod interval.

Parameters:

frequency - The metadata sync interval, in seconds.

See Also:

setServiceMetaPeriod(int), getServiceMetaPeriod()

setQuarantineFutureSecs

public void setQuarantineFutureSecs(int window)

Sets a quarantine for events that are timestamped in the future to help prevent main hot buckets from being polluted with fringe events. Events that are newer than "now" plus this value are quarantined.

Parameters:

window - The future event-time quarantine, in seconds.

setQuarantinePastSecs

public void setQuarantinePastSecs(int window)

Sets a quarantine for events that are timestamped in the past to help prevent main hot buckets from being polluted with fringe events. Events that are older than "now" plus this value are quarantined.

Parameters:

window - The past event-time quarantine, in seconds.

setRawChunkSizeBytes

public void setRawChunkSizeBytes(int size)

Sets the target uncompressed size of individual raw slices in the rawdata journal for this index.

This parameter only specifies a target chunk size. The actual chunk size might be slightly larger by an amount proportional to an individual event size.

WARNING: This is an advanced parameter. Only change it if you are instructed to do so by Splunk Support.

Parameters:

size - The target uncompressed size, in bytes. (0 is not a valid value--if 0 is used, this parameter is set to the default value.)

setRotatePeriodInSecs

public void setRotatePeriodInSecs(int frequency)

Sets the frequency to check for the need to create a new hot bucket and the need to roll or freeze any warm or cold buckets for this index.

Parameters:

frequency - The check frequency, in seconds.

setServiceMetaPeriod

public void setServiceMetaPeriod(int frequency)

Sets the frequency at which metadata is synced to disk for this index.

Parameters:

frequency - The meta data sync frequency, in seconds.

setSyncMeta

public void setSyncMeta(boolean sync)

Sets whether the sync operation is called before the file descriptor is closed on metadata updates.

This functionality improves the integrity of metadata files, especially with regard to operating system crashes and machine failures.

WARNING: This is an advanced parameter. Only change it if you are instructed to do so by Splunk Support.

Parameters:

sync - true to call the sync operation before the file descriptor is closed on metadata updates, false if not.

setThrottleCheckPeriod

public void setThrottleCheckPeriod(int frequency)

Sets the frequency at which Splunk checks for an index throttling condition.

Parameters:

frequency - The frequency of the throttling check, in seconds.

submit

public void submit(java.lang.String data)

Submits an event to this index through an HTTP POST request.

Parameters:

data - The event data to post.

submit

public void submit(Args args,
                   java.lang.String data)

Submits an event to this index through an HTTP POST request.

Parameters:

args - Optional arguments for this request. Valid parameters are: "host", "host_regex", "source", and "sourcetype".

data - The event data to post.

upload

public void upload(java.lang.String filename)

Uploads a file to this index as an event stream.

Note: This file must be directly accessible by the Splunk server.

Parameters:

filename - The path and filename.