Study guide
4.4 indexes.conf Options: Paths, Bucket Sizing & Volumes
Splunk Enterprise Certified Admin SPLK-1003
Track your progress as you read
Finished sections get a check mark.
1 Introduction
About the Splunk Enterprise Certified Admin Exam
2 Chapter 1: Splunk Admin Basics
1.1 Splunk Enterprise Architecture & Core Components
3 Chapter 2: License Management
2.1 License Types, Stacks, Pools & Licensing Architecture 2.2 License Violations, Rolling Window Warnings & Troubleshooting
4 Chapter 3: Splunk Configuration Files
3.1 Splunk Configuration Directory Structure 3.2 Configuration Layering, Precedence & Resolution Rules 3.3 Using btool to Inspect & Debug Configurations
5 Chapter 4: Splunk Indexes
4.1 Index Structure: Directories, Buckets & Bucket Files 4.2 Bucket Types & the Hot-Warm-Cold-Frozen-Thawed Lifecycle 4.3 Checking Index Data Integrity 4.4 indexes.conf Options: Paths, Bucket Sizing & Volumes 4.5 The Fishbucket: File Tracking, CRC Collisions & Re-reading Files 4.6 Applying a Data Retention Policy
6 Chapter 5: Splunk User Management
5.1 Splunk Roles, Capabilities & Custom Role Design 5.2 User Account Administration, Search Restrictions & Limits
7 Chapter 6: Splunk Authentication Management
6.1 Integrating Splunk with LDAP 6.2 Other Authentication Options & Enabling Multifactor Authentication
8 Chapter 7: Getting Data In
7.1 CLI Administration & Basic Data Onboarding Workflows 7.2 Forwarder Types: Universal Forwarder vs. Heavy Forwarder
9 Chapter 8: Distributed Search
8.1 How Distributed Search Works 8.2 Roles of the Search Head and Search Peers 8.3 Configuring Search Peers & Distributed Search Groups 8.4 Search Head Scaling & Search Head Clustering (SHC)
10 Chapter 9: Getting Data In – Staging
9.1 Ingestion Pipeline Stages: Input, Parsing, Merging, Typing & Indexing 9.2 Pipeline Component Placement & Queue Management 9.3 Splunk Input Options
11 Chapter 10: Configuring Forwarders
10.1 Forwarder Setup & outputs.conf Load Balancing 10.2 Indexer Acknowledgment, Data Cloning & Forwarder Routing
12 Chapter 11: Forwarder Management
11.1 Deployment Management & the Deployment Server 11.2 Deployment Apps & Deployment Clients 11.3 Server Classes, Client Grouping & App Deployment Strategies 11.4 Forwarder Management Monitoring & Troubleshooting
13 Chapter 12: Monitor Inputs
12.1 File & Directory Monitoring Mechanics 12.2 Monitor Input Tuning: Whitelists, Blacklists & CRC Settings 12.3 Deploying a Remote Monitor Input, Network Shares & Archives
14 Chapter 13: Network and Scripted Inputs
13.1 Creating Network Inputs: TCP & UDP 13.2 Optional Settings for Network Inputs 13.3 Scripted Inputs & PowerShell Data Collection
15 Chapter 14: Agentless Inputs
14.1 Windows Management Instrumentation (WMI) Inputs 14.2 HTTP Event Collector (HEC) Architecture & Administration
16 Chapter 15: Fine Tuning Inputs
15.1 Input-Phase Processing & Default Metadata Assignment 15.2 Character Set Encoding & Handling Binary Data
17 Chapter 16: Parsing Phase and Data
16.1 Line Breaking & Event Segmentation 16.2 Timestamp Extraction, Time Zones & Clock Skew Handling 16.3 Validating Event Parsing with Data Preview
18 Chapter 17: Manipulating Raw Data
17.1 Transformation Mechanics: props.conf & transforms.conf 17.2 Data Masking, Redaction & SEDCMD 17.3 Event Routing, Dynamic Index Assignment & Filtering to nullQueue
4.4 indexes.conf Options: Paths, Bucket Sizing & Volumes
Key Takeaways Explain This Topic AI
Each index is a stanza in indexes.conf on the indexers; homePath, coldPath, and thawedPath are required, and thawedPath cannot use a volume reference.
maxDataSize = auto caps hot buckets at 750 MB; auto_high_volume raises it to 10 GB on 64-bit systems and is recommended for indexes above about 10 GB/day.
maxWarmDBCount (default 300) limits warm buckets in homePath; maxHotSpanSecs (default 90 days) limits the time span of a hot bucket.
A [volume:<name>] stanza with maxVolumeDataSizeMB caps the combined size of every index path that references the volume.
When a volume is over its cap, Splunk moves the buckets with the oldest latest-time across all indexes on the volume, even directly from hot to cold.
Last updated: September 2026
indexes.conf Options: Paths, Bucket Sizing, and Volumes
All physical storage paths, bucket sizing thresholds, bucket roll triggers, and aging retention policies in Splunk Enterprise are governed by indexes.conf . Located on indexers and cluster peer nodes, indexes.conf controls how storage resources are allocated and ensures that disk partitions do not fill up unexpectedly.
Mastering the attributes inside indexes.conf is essential for balancing ingest throughput, search performance, hardware expenditure, and regulatory retention requirements.
Comprehensive Breakdown of indexes.conf Attributes
Every user-defined index is configured within its own stanza in indexes.conf (e.g., [web_traffic] , [firewall] ). In addition, global defaults can be established in the [default] stanza. [web_traffic]
- homePath = /opt/splunk/var/lib/splunk/web_traffic/db
- coldPath = /mnt/cold_storage/web_traffic/colddb
- thawedPath = /opt/splunk/var/lib/splunk/web_traffic/thaweddb
- maxDataSize = auto_high_volume
- maxWarmDBCount = 400
- maxHotSpanSecs = 7776000
- maxTotalDataSizeMB = 1000000
- frozenTimePeriodInSecs = 15552000
- Core Attribute Reference Table
Attribute Name Default Value Value Types Architectural Function & Administrative Impact
homePath $SPLUNK_DB/<index>/db Filesystem path / Volume ref Directory target housing all hot and warm buckets. Must be located on high-performance storage.
coldPath $SPLUNK_DB/<index>/colddb Filesystem path / Volume ref Directory target housing all cold buckets. Typically located on lower-cost, high-density disk arrays.
thawedPath $SPLUNK_DB/<index>/thaweddb Absolute filesystem path Target directory where archived buckets are restored. Cannot reference a volume. Exempt from retention policies.
maxDataSize auto (750 MB) auto , auto_high_volume , integer (MB) Maximum size of an individual hot bucket before rolling to warm. auto_high_volume sets size to 10 GB on 64-bit systems.
maxWarmDBCount 300 Integer Maximum number of warm buckets allowed in homePath before the oldest warm bucket rolls to coldPath .
maxHotSpanSecs 7776000 (90 days) Integer (seconds) Maximum time window between earliest and latest event in an individual hot bucket before rolling to warm.
maxHotBuckets auto (3 per ingestion pipeline) Integer or auto Maximum hot buckets per index. When exceeded, the hot bucket with the least recent data rolls to warm.
maxTotalDataSizeMB 500000 (~500 GB) Integer (MB) Maximum allowable disk footprint of the index (hot + warm + cold). Exceeding this causes oldest buckets to freeze.
frozenTimePeriodInSecs 188697600 (~6 years) Integer (seconds) Maximum age of data. A bucket freezes only when every event in it is older than this.
coldToFrozenDir None (empty) Absolute filesystem path Archive directory for frozen buckets (rawdata only is kept). If neither it nor a script is set, frozen buckets are deleted.
coldToFrozenScript None (empty) Absolute path to executable Command-line script invoked by splunkd when a bucket freezes. Takes bucket path as an argument.
Bucket Sizing: auto vs. auto_high_volume
The maxDataSize attribute directly dictates how large an individual hot bucket can grow before Splunk seals it and rolls it into warm storage. Configuring this setting appropriately is critical for indexing health:
maxDataSize = auto
Sets the maximum bucket size to 750 MB .
The default, and the right choice for most indexes.
indexes.conf.spec recommends auto_high_volume instead for "high volume" indexes, which it describes as receiving more than about 10 GB of data per day .
maxDataSize = auto_high_volume
Sets the maximum bucket size to 10 GB on 64-bit systems (1 GB on 32-bit systems).
Recommended for high-volume enterprise ingestion tiers (e.g., firewall logs, netflow, Windows event security channels, endpoint telemetry). Bucket Sizing Impact:
An indexer writing ~500 GB of bucket data per day into one index:
- maxDataSize = auto (750 MB) --> roughly 650+ buckets per day
- maxDataSize = auto_high_volume (10 GB) --> roughly 50 buckets per day
Fewer, larger buckets mean fewer files to open and track per search.
Tip
If an indexer receives large volumes of data and generates thousands of small warm buckets under maxDataSize = auto , searches suffer from overhead because the indexers must open and check far more buckets and tsidx files for every time range. Switching to auto_high_volume dramatically reduces total bucket count and streamlines search execution.
Volume Definitions & Storage Pooling
Configuring static maxTotalDataSizeMB values independently on dozens of indexes can lead to inefficient storage utilization. If Index A is allocated 500 GB and uses 480 GB, while Index B is allocated 500 GB but only uses 50 GB, Index A will begin freezing data prematurely even though the underlying filesystem has hundreds of gigabytes of free disk space.
To solve this, Splunk introduces Storage Volumes via [volume:<volume_name>] stanzas.
How Volumes Work
A volume definition sets a global size cap on an entire physical mount point or disk array. Multiple indexes then reference this shared volume for their homePath and coldPath configurations. # Volume definitions in indexes.conf
- [volume:fast_storage]
- path = /mnt/nvme_pool
- maxVolumeDataSizeMB = 2000000 # 2 TB global ceiling for Hot/Warm
- [volume:cold_storage]
- path = /mnt/hdd_array
- maxVolumeDataSizeMB = 10000000 # 10 TB global ceiling for Cold
# Index stanzas referencing shared volumes
- [network]
- homePath = volume:fast_storage/network/db
- coldPath = volume:cold_storage/network/colddb
- thawedPath = /opt/splunk/var/lib/splunk/network/thaweddb
- maxTotalDataSizeMB = 5000000
- [security]
- homePath = volume:fast_storage/security/db
- coldPath = volume:cold_storage/security/colddb
- thawedPath = /opt/splunk/var/lib/splunk/security/thaweddb
- maxTotalDataSizeMB = 5000000
- [app_logs]
- homePath = volume:fast_storage/app_logs/db
- coldPath = volume:cold_storage/app_logs/colddb
- thawedPath = /opt/splunk/var/lib/splunk/app_logs/thaweddb
- maxTotalDataSizeMB = 5000000
- Dynamic Volume Rolling Mechanics
When multiple indexes share a volume, Splunk monitors the aggregate capacity used across all member directories:
If volume:fast_storage exceeds maxVolumeDataSizeMB , Splunk looks at the buckets of every index that uses that volume ( network , security , app_logs ).
It removes the buckets with the oldest "latest time" (newest event) across the whole volume, moving them to cold, until the volume is under its limit. This trim can even move a bucket straight from hot to cold if it has the oldest latest time.
If volume:cold_storage exceeds its limit, the same rule freezes the cold buckets with the oldest latest time across all indexes on that volume.
Important
When a volume cap is exceeded, which bucket moves is decided by data age across the entire volume , not by which index used the most space. Even if network wrote 80% of the volume's data, an old bucket from security will roll first if its events are chronologically older.