pulumi-splunk 1.3.0a1735837426__py3-none-any.whl → 1.3.0a1763793741__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_splunk/__init__.py +2 -1
- pulumi_splunk/_inputs.py +1275 -1275
- pulumi_splunk/_utilities.py +9 -5
- pulumi_splunk/admin_saml_groups.py +37 -36
- pulumi_splunk/apps_local.py +210 -209
- pulumi_splunk/authentication_users.py +156 -155
- pulumi_splunk/authorization_roles.py +224 -223
- pulumi_splunk/config/__init__.py +2 -1
- pulumi_splunk/config/__init__.pyi +3 -4
- pulumi_splunk/config/vars.py +9 -10
- pulumi_splunk/configs_conf.py +40 -39
- pulumi_splunk/data_ui_views.py +40 -39
- pulumi_splunk/generic_acl.py +23 -22
- pulumi_splunk/global_http_event_collector.py +122 -121
- pulumi_splunk/indexes.py +652 -651
- pulumi_splunk/inputs_http_event_collector.py +159 -158
- pulumi_splunk/inputs_monitor.py +261 -260
- pulumi_splunk/inputs_script.py +159 -158
- pulumi_splunk/inputs_tcp_cooked.py +91 -90
- pulumi_splunk/inputs_tcp_raw.py +176 -175
- pulumi_splunk/inputs_tcp_splunk_tcp_token.py +40 -39
- pulumi_splunk/inputs_tcp_ssl.py +88 -87
- pulumi_splunk/inputs_udp.py +193 -192
- pulumi_splunk/lookup_definition.py +40 -39
- pulumi_splunk/lookup_table_file.py +71 -70
- pulumi_splunk/outputs.py +857 -857
- pulumi_splunk/outputs_tcp_default.py +142 -141
- pulumi_splunk/outputs_tcp_group.py +176 -175
- pulumi_splunk/outputs_tcp_server.py +176 -175
- pulumi_splunk/outputs_tcp_syslog.py +125 -124
- pulumi_splunk/provider.py +94 -78
- pulumi_splunk/pulumi-plugin.json +1 -1
- pulumi_splunk/saved_searches.py +3099 -2886
- pulumi_splunk/sh_indexes_manager.py +74 -73
- {pulumi_splunk-1.3.0a1735837426.dist-info → pulumi_splunk-1.3.0a1763793741.dist-info}/METADATA +3 -3
- pulumi_splunk-1.3.0a1763793741.dist-info/RECORD +39 -0
- {pulumi_splunk-1.3.0a1735837426.dist-info → pulumi_splunk-1.3.0a1763793741.dist-info}/WHEEL +1 -1
- pulumi_splunk-1.3.0a1735837426.dist-info/RECORD +0 -39
- {pulumi_splunk-1.3.0a1735837426.dist-info → pulumi_splunk-1.3.0a1763793741.dist-info}/top_level.txt +0 -0
pulumi_splunk/indexes.py
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
# coding=utf-8
|
|
2
|
-
# *** WARNING: this file was generated by
|
|
2
|
+
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import
|
|
5
|
+
import builtins as _builtins
|
|
6
6
|
import warnings
|
|
7
7
|
import sys
|
|
8
8
|
import pulumi
|
|
@@ -22,57 +22,57 @@ __all__ = ['IndexesArgs', 'Indexes']
|
|
|
22
22
|
class IndexesArgs:
|
|
23
23
|
def __init__(__self__, *,
|
|
24
24
|
acl: Optional[pulumi.Input['IndexesAclArgs']] = None,
|
|
25
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
26
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
27
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
28
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
29
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
30
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
31
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
32
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
33
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
34
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
35
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
36
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
37
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
38
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
39
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
40
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
41
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
42
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
43
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
44
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
45
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
46
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
47
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
48
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
49
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
50
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
51
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
52
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
53
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
54
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
55
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
56
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
57
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
58
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
59
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
60
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
61
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
62
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None):
|
|
25
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
26
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
27
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
28
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
31
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
32
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
33
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
34
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
37
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
38
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
39
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
40
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
41
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
42
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
43
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
44
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
45
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
46
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
47
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
48
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
49
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
50
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
51
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
52
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
53
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
54
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
55
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
56
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
57
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
58
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
59
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
60
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
61
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
62
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None):
|
|
63
63
|
"""
|
|
64
64
|
The set of arguments for constructing a Indexes resource.
|
|
65
65
|
:param pulumi.Input['IndexesAclArgs'] acl: The app/user context that is the namespace for the resource
|
|
66
|
-
:param pulumi.Input[int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
67
|
-
:param pulumi.Input[str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
66
|
+
:param pulumi.Input[_builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
67
|
+
:param pulumi.Input[_builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
68
68
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
69
69
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
70
70
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
71
71
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
72
72
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
73
73
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
74
|
-
:param pulumi.Input[str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
75
|
-
:param pulumi.Input[str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
74
|
+
:param pulumi.Input[_builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
75
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
76
76
|
<br>
|
|
77
77
|
Bucket freezing policy is as follows:<br>
|
|
78
78
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -80,70 +80,70 @@ class IndexesArgs:
|
|
|
80
80
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
81
81
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
82
82
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
83
|
-
:param pulumi.Input[str] cold_to_frozen_script: Path to the archiving script.
|
|
83
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
84
84
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
85
85
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
86
86
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
87
|
-
:param pulumi.Input[bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
88
|
-
:param pulumi.Input[str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
89
|
-
:param pulumi.Input[bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
87
|
+
:param pulumi.Input[_builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
88
|
+
:param pulumi.Input[_builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
89
|
+
:param pulumi.Input[_builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
90
90
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
91
|
-
:param pulumi.Input[int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
91
|
+
:param pulumi.Input[_builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
92
92
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
93
|
-
:param pulumi.Input[str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
93
|
+
:param pulumi.Input[_builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
94
94
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
95
95
|
<br>Caution: The path must be readable and writable.
|
|
96
|
-
:param pulumi.Input[str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
96
|
+
:param pulumi.Input[_builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
97
97
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
98
|
-
:param pulumi.Input[int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
98
|
+
:param pulumi.Input[_builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
99
99
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
100
|
-
:param pulumi.Input[str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
100
|
+
:param pulumi.Input[_builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
101
101
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
102
|
-
:param pulumi.Input[int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
102
|
+
:param pulumi.Input[_builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
103
103
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
104
|
-
:param pulumi.Input[int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
105
|
-
:param pulumi.Input[int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
106
|
-
:param pulumi.Input[int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
107
|
-
:param pulumi.Input[int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
108
|
-
:param pulumi.Input[int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
104
|
+
:param pulumi.Input[_builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
105
|
+
:param pulumi.Input[_builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
106
|
+
:param pulumi.Input[_builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
107
|
+
:param pulumi.Input[_builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
108
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
109
109
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
110
110
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
111
|
-
:param pulumi.Input[int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
111
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
112
112
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
113
113
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
114
|
-
:param pulumi.Input[int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
115
|
-
:param pulumi.Input[int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
116
|
-
:param pulumi.Input[str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
114
|
+
:param pulumi.Input[_builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
115
|
+
:param pulumi.Input[_builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
116
|
+
:param pulumi.Input[_builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
117
117
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
118
118
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
119
119
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
120
|
-
:param pulumi.Input[int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
121
|
-
:param pulumi.Input[str] name: The name of the index to create.
|
|
122
|
-
:param pulumi.Input[int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
120
|
+
:param pulumi.Input[_builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
121
|
+
:param pulumi.Input[_builtins.str] name: The name of the index to create.
|
|
122
|
+
:param pulumi.Input[_builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
123
123
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
124
124
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
125
125
|
By default it is turned off (zero).
|
|
126
|
-
:param pulumi.Input[int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
126
|
+
:param pulumi.Input[_builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
127
127
|
If set to 0, the indexer checks child process status every second.
|
|
128
128
|
Highest legal value is 4294967295.
|
|
129
|
-
:param pulumi.Input[int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
129
|
+
:param pulumi.Input[_builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
130
130
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
131
|
-
:param pulumi.Input[int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
132
|
-
:param pulumi.Input[int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
133
|
-
:param pulumi.Input[str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
131
|
+
:param pulumi.Input[_builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
132
|
+
:param pulumi.Input[_builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
133
|
+
:param pulumi.Input[_builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
134
134
|
auto = Use the master index replication configuration value.
|
|
135
135
|
0 = Turn off replication for this index.
|
|
136
|
-
:param pulumi.Input[int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
137
|
-
:param pulumi.Input[int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
136
|
+
:param pulumi.Input[_builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
137
|
+
:param pulumi.Input[_builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
138
138
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
139
|
-
:param pulumi.Input[bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
140
|
-
:param pulumi.Input[str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
139
|
+
:param pulumi.Input[_builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
140
|
+
:param pulumi.Input[_builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
141
141
|
Cannot be defined in terms of a volume definition.
|
|
142
142
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
143
|
-
:param pulumi.Input[int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
144
|
-
:param pulumi.Input[str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
143
|
+
:param pulumi.Input[_builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
144
|
+
:param pulumi.Input[_builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
145
145
|
If specified, it must be defined in terms of a volume definition.
|
|
146
|
-
:param pulumi.Input[str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
146
|
+
:param pulumi.Input[_builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
147
147
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
148
148
|
"""
|
|
149
149
|
if acl is not None:
|
|
@@ -225,7 +225,7 @@ class IndexesArgs:
|
|
|
225
225
|
if warm_to_cold_script is not None:
|
|
226
226
|
pulumi.set(__self__, "warm_to_cold_script", warm_to_cold_script)
|
|
227
227
|
|
|
228
|
-
@property
|
|
228
|
+
@_builtins.property
|
|
229
229
|
@pulumi.getter
|
|
230
230
|
def acl(self) -> Optional[pulumi.Input['IndexesAclArgs']]:
|
|
231
231
|
"""
|
|
@@ -237,21 +237,21 @@ class IndexesArgs:
|
|
|
237
237
|
def acl(self, value: Optional[pulumi.Input['IndexesAclArgs']]):
|
|
238
238
|
pulumi.set(self, "acl", value)
|
|
239
239
|
|
|
240
|
-
@property
|
|
240
|
+
@_builtins.property
|
|
241
241
|
@pulumi.getter(name="blockSignSize")
|
|
242
|
-
def block_sign_size(self) -> Optional[pulumi.Input[int]]:
|
|
242
|
+
def block_sign_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
243
243
|
"""
|
|
244
244
|
Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
245
245
|
"""
|
|
246
246
|
return pulumi.get(self, "block_sign_size")
|
|
247
247
|
|
|
248
248
|
@block_sign_size.setter
|
|
249
|
-
def block_sign_size(self, value: Optional[pulumi.Input[int]]):
|
|
249
|
+
def block_sign_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
250
250
|
pulumi.set(self, "block_sign_size", value)
|
|
251
251
|
|
|
252
|
-
@property
|
|
252
|
+
@_builtins.property
|
|
253
253
|
@pulumi.getter(name="bucketRebuildMemoryHint")
|
|
254
|
-
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[str]]:
|
|
254
|
+
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
255
255
|
"""
|
|
256
256
|
Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
257
257
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
@@ -264,24 +264,24 @@ class IndexesArgs:
|
|
|
264
264
|
return pulumi.get(self, "bucket_rebuild_memory_hint")
|
|
265
265
|
|
|
266
266
|
@bucket_rebuild_memory_hint.setter
|
|
267
|
-
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[str]]):
|
|
267
|
+
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
268
268
|
pulumi.set(self, "bucket_rebuild_memory_hint", value)
|
|
269
269
|
|
|
270
|
-
@property
|
|
270
|
+
@_builtins.property
|
|
271
271
|
@pulumi.getter(name="coldPath")
|
|
272
|
-
def cold_path(self) -> Optional[pulumi.Input[str]]:
|
|
272
|
+
def cold_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
273
273
|
"""
|
|
274
274
|
An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
275
275
|
"""
|
|
276
276
|
return pulumi.get(self, "cold_path")
|
|
277
277
|
|
|
278
278
|
@cold_path.setter
|
|
279
|
-
def cold_path(self, value: Optional[pulumi.Input[str]]):
|
|
279
|
+
def cold_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
280
280
|
pulumi.set(self, "cold_path", value)
|
|
281
281
|
|
|
282
|
-
@property
|
|
282
|
+
@_builtins.property
|
|
283
283
|
@pulumi.getter(name="coldToFrozenDir")
|
|
284
|
-
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[str]]:
|
|
284
|
+
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
285
285
|
"""
|
|
286
286
|
Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
287
287
|
<br>
|
|
@@ -295,12 +295,12 @@ class IndexesArgs:
|
|
|
295
295
|
return pulumi.get(self, "cold_to_frozen_dir")
|
|
296
296
|
|
|
297
297
|
@cold_to_frozen_dir.setter
|
|
298
|
-
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[str]]):
|
|
298
|
+
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
299
299
|
pulumi.set(self, "cold_to_frozen_dir", value)
|
|
300
300
|
|
|
301
|
-
@property
|
|
301
|
+
@_builtins.property
|
|
302
302
|
@pulumi.getter(name="coldToFrozenScript")
|
|
303
|
-
def cold_to_frozen_script(self) -> Optional[pulumi.Input[str]]:
|
|
303
|
+
def cold_to_frozen_script(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
304
304
|
"""
|
|
305
305
|
Path to the archiving script.
|
|
306
306
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
@@ -310,36 +310,36 @@ class IndexesArgs:
|
|
|
310
310
|
return pulumi.get(self, "cold_to_frozen_script")
|
|
311
311
|
|
|
312
312
|
@cold_to_frozen_script.setter
|
|
313
|
-
def cold_to_frozen_script(self, value: Optional[pulumi.Input[str]]):
|
|
313
|
+
def cold_to_frozen_script(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
314
314
|
pulumi.set(self, "cold_to_frozen_script", value)
|
|
315
315
|
|
|
316
|
-
@property
|
|
316
|
+
@_builtins.property
|
|
317
317
|
@pulumi.getter(name="compressRawdata")
|
|
318
|
-
def compress_rawdata(self) -> Optional[pulumi.Input[bool]]:
|
|
318
|
+
def compress_rawdata(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
319
319
|
"""
|
|
320
320
|
This parameter is ignored. The splunkd process always compresses raw data.
|
|
321
321
|
"""
|
|
322
322
|
return pulumi.get(self, "compress_rawdata")
|
|
323
323
|
|
|
324
324
|
@compress_rawdata.setter
|
|
325
|
-
def compress_rawdata(self, value: Optional[pulumi.Input[bool]]):
|
|
325
|
+
def compress_rawdata(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
326
326
|
pulumi.set(self, "compress_rawdata", value)
|
|
327
327
|
|
|
328
|
-
@property
|
|
328
|
+
@_builtins.property
|
|
329
329
|
@pulumi.getter
|
|
330
|
-
def datatype(self) -> Optional[pulumi.Input[str]]:
|
|
330
|
+
def datatype(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
331
331
|
"""
|
|
332
332
|
Valid values: (event | metric). Specifies the type of index.
|
|
333
333
|
"""
|
|
334
334
|
return pulumi.get(self, "datatype")
|
|
335
335
|
|
|
336
336
|
@datatype.setter
|
|
337
|
-
def datatype(self, value: Optional[pulumi.Input[str]]):
|
|
337
|
+
def datatype(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
338
338
|
pulumi.set(self, "datatype", value)
|
|
339
339
|
|
|
340
|
-
@property
|
|
340
|
+
@_builtins.property
|
|
341
341
|
@pulumi.getter(name="enableOnlineBucketRepair")
|
|
342
|
-
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[bool]]:
|
|
342
|
+
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
343
343
|
"""
|
|
344
344
|
Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
345
345
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
@@ -347,12 +347,12 @@ class IndexesArgs:
|
|
|
347
347
|
return pulumi.get(self, "enable_online_bucket_repair")
|
|
348
348
|
|
|
349
349
|
@enable_online_bucket_repair.setter
|
|
350
|
-
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[bool]]):
|
|
350
|
+
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
351
351
|
pulumi.set(self, "enable_online_bucket_repair", value)
|
|
352
352
|
|
|
353
|
-
@property
|
|
353
|
+
@_builtins.property
|
|
354
354
|
@pulumi.getter(name="frozenTimePeriodInSecs")
|
|
355
|
-
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[int]]:
|
|
355
|
+
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
356
356
|
"""
|
|
357
357
|
Number of seconds after which indexed data rolls to frozen.
|
|
358
358
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
@@ -360,12 +360,12 @@ class IndexesArgs:
|
|
|
360
360
|
return pulumi.get(self, "frozen_time_period_in_secs")
|
|
361
361
|
|
|
362
362
|
@frozen_time_period_in_secs.setter
|
|
363
|
-
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[int]]):
|
|
363
|
+
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
364
364
|
pulumi.set(self, "frozen_time_period_in_secs", value)
|
|
365
365
|
|
|
366
|
-
@property
|
|
366
|
+
@_builtins.property
|
|
367
367
|
@pulumi.getter(name="homePath")
|
|
368
|
-
def home_path(self) -> Optional[pulumi.Input[str]]:
|
|
368
|
+
def home_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
369
369
|
"""
|
|
370
370
|
An absolute path that contains the hot and warm buckets for the index.
|
|
371
371
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
@@ -374,12 +374,12 @@ class IndexesArgs:
|
|
|
374
374
|
return pulumi.get(self, "home_path")
|
|
375
375
|
|
|
376
376
|
@home_path.setter
|
|
377
|
-
def home_path(self, value: Optional[pulumi.Input[str]]):
|
|
377
|
+
def home_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
378
378
|
pulumi.set(self, "home_path", value)
|
|
379
379
|
|
|
380
|
-
@property
|
|
380
|
+
@_builtins.property
|
|
381
381
|
@pulumi.getter(name="maxBloomBackfillBucketAge")
|
|
382
|
-
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[str]]:
|
|
382
|
+
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
383
383
|
"""
|
|
384
384
|
Valid values are: Integer[m|s|h|d].
|
|
385
385
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
@@ -387,12 +387,12 @@ class IndexesArgs:
|
|
|
387
387
|
return pulumi.get(self, "max_bloom_backfill_bucket_age")
|
|
388
388
|
|
|
389
389
|
@max_bloom_backfill_bucket_age.setter
|
|
390
|
-
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[str]]):
|
|
390
|
+
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
391
391
|
pulumi.set(self, "max_bloom_backfill_bucket_age", value)
|
|
392
392
|
|
|
393
|
-
@property
|
|
393
|
+
@_builtins.property
|
|
394
394
|
@pulumi.getter(name="maxConcurrentOptimizes")
|
|
395
|
-
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[int]]:
|
|
395
|
+
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
396
396
|
"""
|
|
397
397
|
The number of concurrent optimize processes that can run against a hot bucket.
|
|
398
398
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
@@ -400,12 +400,12 @@ class IndexesArgs:
|
|
|
400
400
|
return pulumi.get(self, "max_concurrent_optimizes")
|
|
401
401
|
|
|
402
402
|
@max_concurrent_optimizes.setter
|
|
403
|
-
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[int]]):
|
|
403
|
+
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
404
404
|
pulumi.set(self, "max_concurrent_optimizes", value)
|
|
405
405
|
|
|
406
|
-
@property
|
|
406
|
+
@_builtins.property
|
|
407
407
|
@pulumi.getter(name="maxDataSize")
|
|
408
|
-
def max_data_size(self) -> Optional[pulumi.Input[str]]:
|
|
408
|
+
def max_data_size(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
409
409
|
"""
|
|
410
410
|
The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
411
411
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
@@ -413,12 +413,12 @@ class IndexesArgs:
|
|
|
413
413
|
return pulumi.get(self, "max_data_size")
|
|
414
414
|
|
|
415
415
|
@max_data_size.setter
|
|
416
|
-
def max_data_size(self, value: Optional[pulumi.Input[str]]):
|
|
416
|
+
def max_data_size(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
417
417
|
pulumi.set(self, "max_data_size", value)
|
|
418
418
|
|
|
419
|
-
@property
|
|
419
|
+
@_builtins.property
|
|
420
420
|
@pulumi.getter(name="maxHotBuckets")
|
|
421
|
-
def max_hot_buckets(self) -> Optional[pulumi.Input[int]]:
|
|
421
|
+
def max_hot_buckets(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
422
422
|
"""
|
|
423
423
|
Maximum hot buckets that can exist per index. Defaults to 3.
|
|
424
424
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
@@ -426,60 +426,60 @@ class IndexesArgs:
|
|
|
426
426
|
return pulumi.get(self, "max_hot_buckets")
|
|
427
427
|
|
|
428
428
|
@max_hot_buckets.setter
|
|
429
|
-
def max_hot_buckets(self, value: Optional[pulumi.Input[int]]):
|
|
429
|
+
def max_hot_buckets(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
430
430
|
pulumi.set(self, "max_hot_buckets", value)
|
|
431
431
|
|
|
432
|
-
@property
|
|
432
|
+
@_builtins.property
|
|
433
433
|
@pulumi.getter(name="maxHotIdleSecs")
|
|
434
|
-
def max_hot_idle_secs(self) -> Optional[pulumi.Input[int]]:
|
|
434
|
+
def max_hot_idle_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
435
435
|
"""
|
|
436
436
|
Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
437
437
|
"""
|
|
438
438
|
return pulumi.get(self, "max_hot_idle_secs")
|
|
439
439
|
|
|
440
440
|
@max_hot_idle_secs.setter
|
|
441
|
-
def max_hot_idle_secs(self, value: Optional[pulumi.Input[int]]):
|
|
441
|
+
def max_hot_idle_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
442
442
|
pulumi.set(self, "max_hot_idle_secs", value)
|
|
443
443
|
|
|
444
|
-
@property
|
|
444
|
+
@_builtins.property
|
|
445
445
|
@pulumi.getter(name="maxHotSpanSecs")
|
|
446
|
-
def max_hot_span_secs(self) -> Optional[pulumi.Input[int]]:
|
|
446
|
+
def max_hot_span_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
447
447
|
"""
|
|
448
448
|
Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
449
449
|
"""
|
|
450
450
|
return pulumi.get(self, "max_hot_span_secs")
|
|
451
451
|
|
|
452
452
|
@max_hot_span_secs.setter
|
|
453
|
-
def max_hot_span_secs(self, value: Optional[pulumi.Input[int]]):
|
|
453
|
+
def max_hot_span_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
454
454
|
pulumi.set(self, "max_hot_span_secs", value)
|
|
455
455
|
|
|
456
|
-
@property
|
|
456
|
+
@_builtins.property
|
|
457
457
|
@pulumi.getter(name="maxMemMb")
|
|
458
|
-
def max_mem_mb(self) -> Optional[pulumi.Input[int]]:
|
|
458
|
+
def max_mem_mb(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
459
459
|
"""
|
|
460
460
|
The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
461
461
|
"""
|
|
462
462
|
return pulumi.get(self, "max_mem_mb")
|
|
463
463
|
|
|
464
464
|
@max_mem_mb.setter
|
|
465
|
-
def max_mem_mb(self, value: Optional[pulumi.Input[int]]):
|
|
465
|
+
def max_mem_mb(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
466
466
|
pulumi.set(self, "max_mem_mb", value)
|
|
467
467
|
|
|
468
|
-
@property
|
|
468
|
+
@_builtins.property
|
|
469
469
|
@pulumi.getter(name="maxMetaEntries")
|
|
470
|
-
def max_meta_entries(self) -> Optional[pulumi.Input[int]]:
|
|
470
|
+
def max_meta_entries(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
471
471
|
"""
|
|
472
472
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
473
473
|
"""
|
|
474
474
|
return pulumi.get(self, "max_meta_entries")
|
|
475
475
|
|
|
476
476
|
@max_meta_entries.setter
|
|
477
|
-
def max_meta_entries(self, value: Optional[pulumi.Input[int]]):
|
|
477
|
+
def max_meta_entries(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
478
478
|
pulumi.set(self, "max_meta_entries", value)
|
|
479
479
|
|
|
480
|
-
@property
|
|
480
|
+
@_builtins.property
|
|
481
481
|
@pulumi.getter(name="maxTimeUnreplicatedNoAcks")
|
|
482
|
-
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[int]]:
|
|
482
|
+
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
483
483
|
"""
|
|
484
484
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
485
485
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
@@ -488,12 +488,12 @@ class IndexesArgs:
|
|
|
488
488
|
return pulumi.get(self, "max_time_unreplicated_no_acks")
|
|
489
489
|
|
|
490
490
|
@max_time_unreplicated_no_acks.setter
|
|
491
|
-
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[int]]):
|
|
491
|
+
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
492
492
|
pulumi.set(self, "max_time_unreplicated_no_acks", value)
|
|
493
493
|
|
|
494
|
-
@property
|
|
494
|
+
@_builtins.property
|
|
495
495
|
@pulumi.getter(name="maxTimeUnreplicatedWithAcks")
|
|
496
|
-
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[int]]:
|
|
496
|
+
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
497
497
|
"""
|
|
498
498
|
Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
499
499
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
@@ -502,36 +502,36 @@ class IndexesArgs:
|
|
|
502
502
|
return pulumi.get(self, "max_time_unreplicated_with_acks")
|
|
503
503
|
|
|
504
504
|
@max_time_unreplicated_with_acks.setter
|
|
505
|
-
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[int]]):
|
|
505
|
+
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
506
506
|
pulumi.set(self, "max_time_unreplicated_with_acks", value)
|
|
507
507
|
|
|
508
|
-
@property
|
|
508
|
+
@_builtins.property
|
|
509
509
|
@pulumi.getter(name="maxTotalDataSizeMb")
|
|
510
|
-
def max_total_data_size_mb(self) -> Optional[pulumi.Input[int]]:
|
|
510
|
+
def max_total_data_size_mb(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
511
511
|
"""
|
|
512
512
|
The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
513
513
|
"""
|
|
514
514
|
return pulumi.get(self, "max_total_data_size_mb")
|
|
515
515
|
|
|
516
516
|
@max_total_data_size_mb.setter
|
|
517
|
-
def max_total_data_size_mb(self, value: Optional[pulumi.Input[int]]):
|
|
517
|
+
def max_total_data_size_mb(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
518
518
|
pulumi.set(self, "max_total_data_size_mb", value)
|
|
519
519
|
|
|
520
|
-
@property
|
|
520
|
+
@_builtins.property
|
|
521
521
|
@pulumi.getter(name="maxWarmDbCount")
|
|
522
|
-
def max_warm_db_count(self) -> Optional[pulumi.Input[int]]:
|
|
522
|
+
def max_warm_db_count(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
523
523
|
"""
|
|
524
524
|
The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
525
525
|
"""
|
|
526
526
|
return pulumi.get(self, "max_warm_db_count")
|
|
527
527
|
|
|
528
528
|
@max_warm_db_count.setter
|
|
529
|
-
def max_warm_db_count(self, value: Optional[pulumi.Input[int]]):
|
|
529
|
+
def max_warm_db_count(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
530
530
|
pulumi.set(self, "max_warm_db_count", value)
|
|
531
531
|
|
|
532
|
-
@property
|
|
532
|
+
@_builtins.property
|
|
533
533
|
@pulumi.getter(name="minRawFileSyncSecs")
|
|
534
|
-
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[str]]:
|
|
534
|
+
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
535
535
|
"""
|
|
536
536
|
Specify an integer (or "disable") for this parameter.
|
|
537
537
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
@@ -541,36 +541,36 @@ class IndexesArgs:
|
|
|
541
541
|
return pulumi.get(self, "min_raw_file_sync_secs")
|
|
542
542
|
|
|
543
543
|
@min_raw_file_sync_secs.setter
|
|
544
|
-
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[str]]):
|
|
544
|
+
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
545
545
|
pulumi.set(self, "min_raw_file_sync_secs", value)
|
|
546
546
|
|
|
547
|
-
@property
|
|
547
|
+
@_builtins.property
|
|
548
548
|
@pulumi.getter(name="minStreamGroupQueueSize")
|
|
549
|
-
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[int]]:
|
|
549
|
+
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
550
550
|
"""
|
|
551
551
|
Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
552
552
|
"""
|
|
553
553
|
return pulumi.get(self, "min_stream_group_queue_size")
|
|
554
554
|
|
|
555
555
|
@min_stream_group_queue_size.setter
|
|
556
|
-
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[int]]):
|
|
556
|
+
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
557
557
|
pulumi.set(self, "min_stream_group_queue_size", value)
|
|
558
558
|
|
|
559
|
-
@property
|
|
559
|
+
@_builtins.property
|
|
560
560
|
@pulumi.getter
|
|
561
|
-
def name(self) -> Optional[pulumi.Input[str]]:
|
|
561
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
562
562
|
"""
|
|
563
563
|
The name of the index to create.
|
|
564
564
|
"""
|
|
565
565
|
return pulumi.get(self, "name")
|
|
566
566
|
|
|
567
567
|
@name.setter
|
|
568
|
-
def name(self, value: Optional[pulumi.Input[str]]):
|
|
568
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
569
569
|
pulumi.set(self, "name", value)
|
|
570
570
|
|
|
571
|
-
@property
|
|
571
|
+
@_builtins.property
|
|
572
572
|
@pulumi.getter(name="partialServiceMetaPeriod")
|
|
573
|
-
def partial_service_meta_period(self) -> Optional[pulumi.Input[int]]:
|
|
573
|
+
def partial_service_meta_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
574
574
|
"""
|
|
575
575
|
Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
576
576
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
@@ -580,12 +580,12 @@ class IndexesArgs:
|
|
|
580
580
|
return pulumi.get(self, "partial_service_meta_period")
|
|
581
581
|
|
|
582
582
|
@partial_service_meta_period.setter
|
|
583
|
-
def partial_service_meta_period(self, value: Optional[pulumi.Input[int]]):
|
|
583
|
+
def partial_service_meta_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
584
584
|
pulumi.set(self, "partial_service_meta_period", value)
|
|
585
585
|
|
|
586
|
-
@property
|
|
586
|
+
@_builtins.property
|
|
587
587
|
@pulumi.getter(name="processTrackerServiceInterval")
|
|
588
|
-
def process_tracker_service_interval(self) -> Optional[pulumi.Input[int]]:
|
|
588
|
+
def process_tracker_service_interval(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
589
589
|
"""
|
|
590
590
|
Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
591
591
|
If set to 0, the indexer checks child process status every second.
|
|
@@ -594,12 +594,12 @@ class IndexesArgs:
|
|
|
594
594
|
return pulumi.get(self, "process_tracker_service_interval")
|
|
595
595
|
|
|
596
596
|
@process_tracker_service_interval.setter
|
|
597
|
-
def process_tracker_service_interval(self, value: Optional[pulumi.Input[int]]):
|
|
597
|
+
def process_tracker_service_interval(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
598
598
|
pulumi.set(self, "process_tracker_service_interval", value)
|
|
599
599
|
|
|
600
|
-
@property
|
|
600
|
+
@_builtins.property
|
|
601
601
|
@pulumi.getter(name="quarantineFutureSecs")
|
|
602
|
-
def quarantine_future_secs(self) -> Optional[pulumi.Input[int]]:
|
|
602
|
+
def quarantine_future_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
603
603
|
"""
|
|
604
604
|
Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
605
605
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
@@ -607,36 +607,36 @@ class IndexesArgs:
|
|
|
607
607
|
return pulumi.get(self, "quarantine_future_secs")
|
|
608
608
|
|
|
609
609
|
@quarantine_future_secs.setter
|
|
610
|
-
def quarantine_future_secs(self, value: Optional[pulumi.Input[int]]):
|
|
610
|
+
def quarantine_future_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
611
611
|
pulumi.set(self, "quarantine_future_secs", value)
|
|
612
612
|
|
|
613
|
-
@property
|
|
613
|
+
@_builtins.property
|
|
614
614
|
@pulumi.getter(name="quarantinePastSecs")
|
|
615
|
-
def quarantine_past_secs(self) -> Optional[pulumi.Input[int]]:
|
|
615
|
+
def quarantine_past_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
616
616
|
"""
|
|
617
617
|
Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
618
618
|
"""
|
|
619
619
|
return pulumi.get(self, "quarantine_past_secs")
|
|
620
620
|
|
|
621
621
|
@quarantine_past_secs.setter
|
|
622
|
-
def quarantine_past_secs(self, value: Optional[pulumi.Input[int]]):
|
|
622
|
+
def quarantine_past_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
623
623
|
pulumi.set(self, "quarantine_past_secs", value)
|
|
624
624
|
|
|
625
|
-
@property
|
|
625
|
+
@_builtins.property
|
|
626
626
|
@pulumi.getter(name="rawChunkSizeBytes")
|
|
627
|
-
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[int]]:
|
|
627
|
+
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
628
628
|
"""
|
|
629
629
|
Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
630
630
|
"""
|
|
631
631
|
return pulumi.get(self, "raw_chunk_size_bytes")
|
|
632
632
|
|
|
633
633
|
@raw_chunk_size_bytes.setter
|
|
634
|
-
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[int]]):
|
|
634
|
+
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
635
635
|
pulumi.set(self, "raw_chunk_size_bytes", value)
|
|
636
636
|
|
|
637
|
-
@property
|
|
637
|
+
@_builtins.property
|
|
638
638
|
@pulumi.getter(name="repFactor")
|
|
639
|
-
def rep_factor(self) -> Optional[pulumi.Input[str]]:
|
|
639
|
+
def rep_factor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
640
640
|
"""
|
|
641
641
|
Index replication control. This parameter applies to only clustering slaves.
|
|
642
642
|
auto = Use the master index replication configuration value.
|
|
@@ -645,24 +645,24 @@ class IndexesArgs:
|
|
|
645
645
|
return pulumi.get(self, "rep_factor")
|
|
646
646
|
|
|
647
647
|
@rep_factor.setter
|
|
648
|
-
def rep_factor(self, value: Optional[pulumi.Input[str]]):
|
|
648
|
+
def rep_factor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
649
649
|
pulumi.set(self, "rep_factor", value)
|
|
650
650
|
|
|
651
|
-
@property
|
|
651
|
+
@_builtins.property
|
|
652
652
|
@pulumi.getter(name="rotatePeriodInSecs")
|
|
653
|
-
def rotate_period_in_secs(self) -> Optional[pulumi.Input[int]]:
|
|
653
|
+
def rotate_period_in_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
654
654
|
"""
|
|
655
655
|
How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
656
656
|
"""
|
|
657
657
|
return pulumi.get(self, "rotate_period_in_secs")
|
|
658
658
|
|
|
659
659
|
@rotate_period_in_secs.setter
|
|
660
|
-
def rotate_period_in_secs(self, value: Optional[pulumi.Input[int]]):
|
|
660
|
+
def rotate_period_in_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
661
661
|
pulumi.set(self, "rotate_period_in_secs", value)
|
|
662
662
|
|
|
663
|
-
@property
|
|
663
|
+
@_builtins.property
|
|
664
664
|
@pulumi.getter(name="serviceMetaPeriod")
|
|
665
|
-
def service_meta_period(self) -> Optional[pulumi.Input[int]]:
|
|
665
|
+
def service_meta_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
666
666
|
"""
|
|
667
667
|
Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
668
668
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
@@ -670,24 +670,24 @@ class IndexesArgs:
|
|
|
670
670
|
return pulumi.get(self, "service_meta_period")
|
|
671
671
|
|
|
672
672
|
@service_meta_period.setter
|
|
673
|
-
def service_meta_period(self, value: Optional[pulumi.Input[int]]):
|
|
673
|
+
def service_meta_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
674
674
|
pulumi.set(self, "service_meta_period", value)
|
|
675
675
|
|
|
676
|
-
@property
|
|
676
|
+
@_builtins.property
|
|
677
677
|
@pulumi.getter(name="syncMeta")
|
|
678
|
-
def sync_meta(self) -> Optional[pulumi.Input[bool]]:
|
|
678
|
+
def sync_meta(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
679
679
|
"""
|
|
680
680
|
When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
681
681
|
"""
|
|
682
682
|
return pulumi.get(self, "sync_meta")
|
|
683
683
|
|
|
684
684
|
@sync_meta.setter
|
|
685
|
-
def sync_meta(self, value: Optional[pulumi.Input[bool]]):
|
|
685
|
+
def sync_meta(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
686
686
|
pulumi.set(self, "sync_meta", value)
|
|
687
687
|
|
|
688
|
-
@property
|
|
688
|
+
@_builtins.property
|
|
689
689
|
@pulumi.getter(name="thawedPath")
|
|
690
|
-
def thawed_path(self) -> Optional[pulumi.Input[str]]:
|
|
690
|
+
def thawed_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
691
691
|
"""
|
|
692
692
|
An absolute path that contains the thawed (resurrected) databases for the index.
|
|
693
693
|
Cannot be defined in terms of a volume definition.
|
|
@@ -696,24 +696,24 @@ class IndexesArgs:
|
|
|
696
696
|
return pulumi.get(self, "thawed_path")
|
|
697
697
|
|
|
698
698
|
@thawed_path.setter
|
|
699
|
-
def thawed_path(self, value: Optional[pulumi.Input[str]]):
|
|
699
|
+
def thawed_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
700
700
|
pulumi.set(self, "thawed_path", value)
|
|
701
701
|
|
|
702
|
-
@property
|
|
702
|
+
@_builtins.property
|
|
703
703
|
@pulumi.getter(name="throttleCheckPeriod")
|
|
704
|
-
def throttle_check_period(self) -> Optional[pulumi.Input[int]]:
|
|
704
|
+
def throttle_check_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
705
705
|
"""
|
|
706
706
|
Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
707
707
|
"""
|
|
708
708
|
return pulumi.get(self, "throttle_check_period")
|
|
709
709
|
|
|
710
710
|
@throttle_check_period.setter
|
|
711
|
-
def throttle_check_period(self, value: Optional[pulumi.Input[int]]):
|
|
711
|
+
def throttle_check_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
712
712
|
pulumi.set(self, "throttle_check_period", value)
|
|
713
713
|
|
|
714
|
-
@property
|
|
714
|
+
@_builtins.property
|
|
715
715
|
@pulumi.getter(name="tstatsHomePath")
|
|
716
|
-
def tstats_home_path(self) -> Optional[pulumi.Input[str]]:
|
|
716
|
+
def tstats_home_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
717
717
|
"""
|
|
718
718
|
Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
719
719
|
If specified, it must be defined in terms of a volume definition.
|
|
@@ -721,12 +721,12 @@ class IndexesArgs:
|
|
|
721
721
|
return pulumi.get(self, "tstats_home_path")
|
|
722
722
|
|
|
723
723
|
@tstats_home_path.setter
|
|
724
|
-
def tstats_home_path(self, value: Optional[pulumi.Input[str]]):
|
|
724
|
+
def tstats_home_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
725
725
|
pulumi.set(self, "tstats_home_path", value)
|
|
726
726
|
|
|
727
|
-
@property
|
|
727
|
+
@_builtins.property
|
|
728
728
|
@pulumi.getter(name="warmToColdScript")
|
|
729
|
-
def warm_to_cold_script(self) -> Optional[pulumi.Input[str]]:
|
|
729
|
+
def warm_to_cold_script(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
730
730
|
"""
|
|
731
731
|
Path to a script to run when moving data from warm to cold.
|
|
732
732
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
@@ -734,7 +734,7 @@ class IndexesArgs:
|
|
|
734
734
|
return pulumi.get(self, "warm_to_cold_script")
|
|
735
735
|
|
|
736
736
|
@warm_to_cold_script.setter
|
|
737
|
-
def warm_to_cold_script(self, value: Optional[pulumi.Input[str]]):
|
|
737
|
+
def warm_to_cold_script(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
738
738
|
pulumi.set(self, "warm_to_cold_script", value)
|
|
739
739
|
|
|
740
740
|
|
|
@@ -742,57 +742,57 @@ class IndexesArgs:
|
|
|
742
742
|
class _IndexesState:
|
|
743
743
|
def __init__(__self__, *,
|
|
744
744
|
acl: Optional[pulumi.Input['IndexesAclArgs']] = None,
|
|
745
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
746
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
747
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
748
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
749
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
750
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
751
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
752
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
753
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
754
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
755
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
756
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
757
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
758
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
759
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
760
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
761
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
762
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
763
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
764
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
765
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
766
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
767
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
768
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
769
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
770
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
771
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
772
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
773
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
774
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
775
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
776
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
777
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
778
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
779
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
780
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
781
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
782
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None):
|
|
745
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
746
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
747
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
748
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
749
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
750
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
751
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
752
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
753
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
754
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
755
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
756
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
757
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
758
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
759
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
760
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
761
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
762
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
763
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
764
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
765
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
766
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
767
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
768
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
769
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
770
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
771
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
772
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
773
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
774
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
775
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
776
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
777
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
778
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
779
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
780
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
781
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
782
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None):
|
|
783
783
|
"""
|
|
784
784
|
Input properties used for looking up and filtering Indexes resources.
|
|
785
785
|
:param pulumi.Input['IndexesAclArgs'] acl: The app/user context that is the namespace for the resource
|
|
786
|
-
:param pulumi.Input[int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
787
|
-
:param pulumi.Input[str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
786
|
+
:param pulumi.Input[_builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
787
|
+
:param pulumi.Input[_builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
788
788
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
789
789
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
790
790
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
791
791
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
792
792
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
793
793
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
794
|
-
:param pulumi.Input[str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
795
|
-
:param pulumi.Input[str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
794
|
+
:param pulumi.Input[_builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
795
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
796
796
|
<br>
|
|
797
797
|
Bucket freezing policy is as follows:<br>
|
|
798
798
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -800,70 +800,70 @@ class _IndexesState:
|
|
|
800
800
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
801
801
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
802
802
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
803
|
-
:param pulumi.Input[str] cold_to_frozen_script: Path to the archiving script.
|
|
803
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
804
804
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
805
805
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
806
806
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
807
|
-
:param pulumi.Input[bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
808
|
-
:param pulumi.Input[str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
809
|
-
:param pulumi.Input[bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
807
|
+
:param pulumi.Input[_builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
808
|
+
:param pulumi.Input[_builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
809
|
+
:param pulumi.Input[_builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
810
810
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
811
|
-
:param pulumi.Input[int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
811
|
+
:param pulumi.Input[_builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
812
812
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
813
|
-
:param pulumi.Input[str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
813
|
+
:param pulumi.Input[_builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
814
814
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
815
815
|
<br>Caution: The path must be readable and writable.
|
|
816
|
-
:param pulumi.Input[str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
816
|
+
:param pulumi.Input[_builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
817
817
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
818
|
-
:param pulumi.Input[int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
818
|
+
:param pulumi.Input[_builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
819
819
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
820
|
-
:param pulumi.Input[str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
820
|
+
:param pulumi.Input[_builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
821
821
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
822
|
-
:param pulumi.Input[int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
822
|
+
:param pulumi.Input[_builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
823
823
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
824
|
-
:param pulumi.Input[int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
825
|
-
:param pulumi.Input[int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
826
|
-
:param pulumi.Input[int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
827
|
-
:param pulumi.Input[int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
828
|
-
:param pulumi.Input[int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
824
|
+
:param pulumi.Input[_builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
825
|
+
:param pulumi.Input[_builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
826
|
+
:param pulumi.Input[_builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
827
|
+
:param pulumi.Input[_builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
828
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
829
829
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
830
830
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
831
|
-
:param pulumi.Input[int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
831
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
832
832
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
833
833
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
834
|
-
:param pulumi.Input[int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
835
|
-
:param pulumi.Input[int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
836
|
-
:param pulumi.Input[str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
834
|
+
:param pulumi.Input[_builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
835
|
+
:param pulumi.Input[_builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
836
|
+
:param pulumi.Input[_builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
837
837
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
838
838
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
839
839
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
840
|
-
:param pulumi.Input[int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
841
|
-
:param pulumi.Input[str] name: The name of the index to create.
|
|
842
|
-
:param pulumi.Input[int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
840
|
+
:param pulumi.Input[_builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
841
|
+
:param pulumi.Input[_builtins.str] name: The name of the index to create.
|
|
842
|
+
:param pulumi.Input[_builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
843
843
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
844
844
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
845
845
|
By default it is turned off (zero).
|
|
846
|
-
:param pulumi.Input[int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
846
|
+
:param pulumi.Input[_builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
847
847
|
If set to 0, the indexer checks child process status every second.
|
|
848
848
|
Highest legal value is 4294967295.
|
|
849
|
-
:param pulumi.Input[int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
849
|
+
:param pulumi.Input[_builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
850
850
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
851
|
-
:param pulumi.Input[int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
852
|
-
:param pulumi.Input[int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
853
|
-
:param pulumi.Input[str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
851
|
+
:param pulumi.Input[_builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
852
|
+
:param pulumi.Input[_builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
853
|
+
:param pulumi.Input[_builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
854
854
|
auto = Use the master index replication configuration value.
|
|
855
855
|
0 = Turn off replication for this index.
|
|
856
|
-
:param pulumi.Input[int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
857
|
-
:param pulumi.Input[int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
856
|
+
:param pulumi.Input[_builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
857
|
+
:param pulumi.Input[_builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
858
858
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
859
|
-
:param pulumi.Input[bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
860
|
-
:param pulumi.Input[str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
859
|
+
:param pulumi.Input[_builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
860
|
+
:param pulumi.Input[_builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
861
861
|
Cannot be defined in terms of a volume definition.
|
|
862
862
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
863
|
-
:param pulumi.Input[int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
864
|
-
:param pulumi.Input[str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
863
|
+
:param pulumi.Input[_builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
864
|
+
:param pulumi.Input[_builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
865
865
|
If specified, it must be defined in terms of a volume definition.
|
|
866
|
-
:param pulumi.Input[str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
866
|
+
:param pulumi.Input[_builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
867
867
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
868
868
|
"""
|
|
869
869
|
if acl is not None:
|
|
@@ -945,7 +945,7 @@ class _IndexesState:
|
|
|
945
945
|
if warm_to_cold_script is not None:
|
|
946
946
|
pulumi.set(__self__, "warm_to_cold_script", warm_to_cold_script)
|
|
947
947
|
|
|
948
|
-
@property
|
|
948
|
+
@_builtins.property
|
|
949
949
|
@pulumi.getter
|
|
950
950
|
def acl(self) -> Optional[pulumi.Input['IndexesAclArgs']]:
|
|
951
951
|
"""
|
|
@@ -957,21 +957,21 @@ class _IndexesState:
|
|
|
957
957
|
def acl(self, value: Optional[pulumi.Input['IndexesAclArgs']]):
|
|
958
958
|
pulumi.set(self, "acl", value)
|
|
959
959
|
|
|
960
|
-
@property
|
|
960
|
+
@_builtins.property
|
|
961
961
|
@pulumi.getter(name="blockSignSize")
|
|
962
|
-
def block_sign_size(self) -> Optional[pulumi.Input[int]]:
|
|
962
|
+
def block_sign_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
963
963
|
"""
|
|
964
964
|
Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
965
965
|
"""
|
|
966
966
|
return pulumi.get(self, "block_sign_size")
|
|
967
967
|
|
|
968
968
|
@block_sign_size.setter
|
|
969
|
-
def block_sign_size(self, value: Optional[pulumi.Input[int]]):
|
|
969
|
+
def block_sign_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
970
970
|
pulumi.set(self, "block_sign_size", value)
|
|
971
971
|
|
|
972
|
-
@property
|
|
972
|
+
@_builtins.property
|
|
973
973
|
@pulumi.getter(name="bucketRebuildMemoryHint")
|
|
974
|
-
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[str]]:
|
|
974
|
+
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
975
975
|
"""
|
|
976
976
|
Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
977
977
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
@@ -984,24 +984,24 @@ class _IndexesState:
|
|
|
984
984
|
return pulumi.get(self, "bucket_rebuild_memory_hint")
|
|
985
985
|
|
|
986
986
|
@bucket_rebuild_memory_hint.setter
|
|
987
|
-
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[str]]):
|
|
987
|
+
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
988
988
|
pulumi.set(self, "bucket_rebuild_memory_hint", value)
|
|
989
989
|
|
|
990
|
-
@property
|
|
990
|
+
@_builtins.property
|
|
991
991
|
@pulumi.getter(name="coldPath")
|
|
992
|
-
def cold_path(self) -> Optional[pulumi.Input[str]]:
|
|
992
|
+
def cold_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
993
993
|
"""
|
|
994
994
|
An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
995
995
|
"""
|
|
996
996
|
return pulumi.get(self, "cold_path")
|
|
997
997
|
|
|
998
998
|
@cold_path.setter
|
|
999
|
-
def cold_path(self, value: Optional[pulumi.Input[str]]):
|
|
999
|
+
def cold_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1000
1000
|
pulumi.set(self, "cold_path", value)
|
|
1001
1001
|
|
|
1002
|
-
@property
|
|
1002
|
+
@_builtins.property
|
|
1003
1003
|
@pulumi.getter(name="coldToFrozenDir")
|
|
1004
|
-
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[str]]:
|
|
1004
|
+
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1005
1005
|
"""
|
|
1006
1006
|
Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1007
1007
|
<br>
|
|
@@ -1015,12 +1015,12 @@ class _IndexesState:
|
|
|
1015
1015
|
return pulumi.get(self, "cold_to_frozen_dir")
|
|
1016
1016
|
|
|
1017
1017
|
@cold_to_frozen_dir.setter
|
|
1018
|
-
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[str]]):
|
|
1018
|
+
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1019
1019
|
pulumi.set(self, "cold_to_frozen_dir", value)
|
|
1020
1020
|
|
|
1021
|
-
@property
|
|
1021
|
+
@_builtins.property
|
|
1022
1022
|
@pulumi.getter(name="coldToFrozenScript")
|
|
1023
|
-
def cold_to_frozen_script(self) -> Optional[pulumi.Input[str]]:
|
|
1023
|
+
def cold_to_frozen_script(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1024
1024
|
"""
|
|
1025
1025
|
Path to the archiving script.
|
|
1026
1026
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
@@ -1030,36 +1030,36 @@ class _IndexesState:
|
|
|
1030
1030
|
return pulumi.get(self, "cold_to_frozen_script")
|
|
1031
1031
|
|
|
1032
1032
|
@cold_to_frozen_script.setter
|
|
1033
|
-
def cold_to_frozen_script(self, value: Optional[pulumi.Input[str]]):
|
|
1033
|
+
def cold_to_frozen_script(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1034
1034
|
pulumi.set(self, "cold_to_frozen_script", value)
|
|
1035
1035
|
|
|
1036
|
-
@property
|
|
1036
|
+
@_builtins.property
|
|
1037
1037
|
@pulumi.getter(name="compressRawdata")
|
|
1038
|
-
def compress_rawdata(self) -> Optional[pulumi.Input[bool]]:
|
|
1038
|
+
def compress_rawdata(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1039
1039
|
"""
|
|
1040
1040
|
This parameter is ignored. The splunkd process always compresses raw data.
|
|
1041
1041
|
"""
|
|
1042
1042
|
return pulumi.get(self, "compress_rawdata")
|
|
1043
1043
|
|
|
1044
1044
|
@compress_rawdata.setter
|
|
1045
|
-
def compress_rawdata(self, value: Optional[pulumi.Input[bool]]):
|
|
1045
|
+
def compress_rawdata(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1046
1046
|
pulumi.set(self, "compress_rawdata", value)
|
|
1047
1047
|
|
|
1048
|
-
@property
|
|
1048
|
+
@_builtins.property
|
|
1049
1049
|
@pulumi.getter
|
|
1050
|
-
def datatype(self) -> Optional[pulumi.Input[str]]:
|
|
1050
|
+
def datatype(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1051
1051
|
"""
|
|
1052
1052
|
Valid values: (event | metric). Specifies the type of index.
|
|
1053
1053
|
"""
|
|
1054
1054
|
return pulumi.get(self, "datatype")
|
|
1055
1055
|
|
|
1056
1056
|
@datatype.setter
|
|
1057
|
-
def datatype(self, value: Optional[pulumi.Input[str]]):
|
|
1057
|
+
def datatype(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1058
1058
|
pulumi.set(self, "datatype", value)
|
|
1059
1059
|
|
|
1060
|
-
@property
|
|
1060
|
+
@_builtins.property
|
|
1061
1061
|
@pulumi.getter(name="enableOnlineBucketRepair")
|
|
1062
|
-
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[bool]]:
|
|
1062
|
+
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1063
1063
|
"""
|
|
1064
1064
|
Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1065
1065
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
@@ -1067,12 +1067,12 @@ class _IndexesState:
|
|
|
1067
1067
|
return pulumi.get(self, "enable_online_bucket_repair")
|
|
1068
1068
|
|
|
1069
1069
|
@enable_online_bucket_repair.setter
|
|
1070
|
-
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[bool]]):
|
|
1070
|
+
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1071
1071
|
pulumi.set(self, "enable_online_bucket_repair", value)
|
|
1072
1072
|
|
|
1073
|
-
@property
|
|
1073
|
+
@_builtins.property
|
|
1074
1074
|
@pulumi.getter(name="frozenTimePeriodInSecs")
|
|
1075
|
-
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1075
|
+
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1076
1076
|
"""
|
|
1077
1077
|
Number of seconds after which indexed data rolls to frozen.
|
|
1078
1078
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
@@ -1080,12 +1080,12 @@ class _IndexesState:
|
|
|
1080
1080
|
return pulumi.get(self, "frozen_time_period_in_secs")
|
|
1081
1081
|
|
|
1082
1082
|
@frozen_time_period_in_secs.setter
|
|
1083
|
-
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1083
|
+
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1084
1084
|
pulumi.set(self, "frozen_time_period_in_secs", value)
|
|
1085
1085
|
|
|
1086
|
-
@property
|
|
1086
|
+
@_builtins.property
|
|
1087
1087
|
@pulumi.getter(name="homePath")
|
|
1088
|
-
def home_path(self) -> Optional[pulumi.Input[str]]:
|
|
1088
|
+
def home_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1089
1089
|
"""
|
|
1090
1090
|
An absolute path that contains the hot and warm buckets for the index.
|
|
1091
1091
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
@@ -1094,12 +1094,12 @@ class _IndexesState:
|
|
|
1094
1094
|
return pulumi.get(self, "home_path")
|
|
1095
1095
|
|
|
1096
1096
|
@home_path.setter
|
|
1097
|
-
def home_path(self, value: Optional[pulumi.Input[str]]):
|
|
1097
|
+
def home_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1098
1098
|
pulumi.set(self, "home_path", value)
|
|
1099
1099
|
|
|
1100
|
-
@property
|
|
1100
|
+
@_builtins.property
|
|
1101
1101
|
@pulumi.getter(name="maxBloomBackfillBucketAge")
|
|
1102
|
-
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[str]]:
|
|
1102
|
+
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1103
1103
|
"""
|
|
1104
1104
|
Valid values are: Integer[m|s|h|d].
|
|
1105
1105
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
@@ -1107,12 +1107,12 @@ class _IndexesState:
|
|
|
1107
1107
|
return pulumi.get(self, "max_bloom_backfill_bucket_age")
|
|
1108
1108
|
|
|
1109
1109
|
@max_bloom_backfill_bucket_age.setter
|
|
1110
|
-
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[str]]):
|
|
1110
|
+
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1111
1111
|
pulumi.set(self, "max_bloom_backfill_bucket_age", value)
|
|
1112
1112
|
|
|
1113
|
-
@property
|
|
1113
|
+
@_builtins.property
|
|
1114
1114
|
@pulumi.getter(name="maxConcurrentOptimizes")
|
|
1115
|
-
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[int]]:
|
|
1115
|
+
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1116
1116
|
"""
|
|
1117
1117
|
The number of concurrent optimize processes that can run against a hot bucket.
|
|
1118
1118
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
@@ -1120,12 +1120,12 @@ class _IndexesState:
|
|
|
1120
1120
|
return pulumi.get(self, "max_concurrent_optimizes")
|
|
1121
1121
|
|
|
1122
1122
|
@max_concurrent_optimizes.setter
|
|
1123
|
-
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[int]]):
|
|
1123
|
+
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1124
1124
|
pulumi.set(self, "max_concurrent_optimizes", value)
|
|
1125
1125
|
|
|
1126
|
-
@property
|
|
1126
|
+
@_builtins.property
|
|
1127
1127
|
@pulumi.getter(name="maxDataSize")
|
|
1128
|
-
def max_data_size(self) -> Optional[pulumi.Input[str]]:
|
|
1128
|
+
def max_data_size(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1129
1129
|
"""
|
|
1130
1130
|
The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1131
1131
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
@@ -1133,12 +1133,12 @@ class _IndexesState:
|
|
|
1133
1133
|
return pulumi.get(self, "max_data_size")
|
|
1134
1134
|
|
|
1135
1135
|
@max_data_size.setter
|
|
1136
|
-
def max_data_size(self, value: Optional[pulumi.Input[str]]):
|
|
1136
|
+
def max_data_size(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1137
1137
|
pulumi.set(self, "max_data_size", value)
|
|
1138
1138
|
|
|
1139
|
-
@property
|
|
1139
|
+
@_builtins.property
|
|
1140
1140
|
@pulumi.getter(name="maxHotBuckets")
|
|
1141
|
-
def max_hot_buckets(self) -> Optional[pulumi.Input[int]]:
|
|
1141
|
+
def max_hot_buckets(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1142
1142
|
"""
|
|
1143
1143
|
Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1144
1144
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
@@ -1146,60 +1146,60 @@ class _IndexesState:
|
|
|
1146
1146
|
return pulumi.get(self, "max_hot_buckets")
|
|
1147
1147
|
|
|
1148
1148
|
@max_hot_buckets.setter
|
|
1149
|
-
def max_hot_buckets(self, value: Optional[pulumi.Input[int]]):
|
|
1149
|
+
def max_hot_buckets(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1150
1150
|
pulumi.set(self, "max_hot_buckets", value)
|
|
1151
1151
|
|
|
1152
|
-
@property
|
|
1152
|
+
@_builtins.property
|
|
1153
1153
|
@pulumi.getter(name="maxHotIdleSecs")
|
|
1154
|
-
def max_hot_idle_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1154
|
+
def max_hot_idle_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1155
1155
|
"""
|
|
1156
1156
|
Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1157
1157
|
"""
|
|
1158
1158
|
return pulumi.get(self, "max_hot_idle_secs")
|
|
1159
1159
|
|
|
1160
1160
|
@max_hot_idle_secs.setter
|
|
1161
|
-
def max_hot_idle_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1161
|
+
def max_hot_idle_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1162
1162
|
pulumi.set(self, "max_hot_idle_secs", value)
|
|
1163
1163
|
|
|
1164
|
-
@property
|
|
1164
|
+
@_builtins.property
|
|
1165
1165
|
@pulumi.getter(name="maxHotSpanSecs")
|
|
1166
|
-
def max_hot_span_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1166
|
+
def max_hot_span_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1167
1167
|
"""
|
|
1168
1168
|
Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1169
1169
|
"""
|
|
1170
1170
|
return pulumi.get(self, "max_hot_span_secs")
|
|
1171
1171
|
|
|
1172
1172
|
@max_hot_span_secs.setter
|
|
1173
|
-
def max_hot_span_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1173
|
+
def max_hot_span_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1174
1174
|
pulumi.set(self, "max_hot_span_secs", value)
|
|
1175
1175
|
|
|
1176
|
-
@property
|
|
1176
|
+
@_builtins.property
|
|
1177
1177
|
@pulumi.getter(name="maxMemMb")
|
|
1178
|
-
def max_mem_mb(self) -> Optional[pulumi.Input[int]]:
|
|
1178
|
+
def max_mem_mb(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1179
1179
|
"""
|
|
1180
1180
|
The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1181
1181
|
"""
|
|
1182
1182
|
return pulumi.get(self, "max_mem_mb")
|
|
1183
1183
|
|
|
1184
1184
|
@max_mem_mb.setter
|
|
1185
|
-
def max_mem_mb(self, value: Optional[pulumi.Input[int]]):
|
|
1185
|
+
def max_mem_mb(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1186
1186
|
pulumi.set(self, "max_mem_mb", value)
|
|
1187
1187
|
|
|
1188
|
-
@property
|
|
1188
|
+
@_builtins.property
|
|
1189
1189
|
@pulumi.getter(name="maxMetaEntries")
|
|
1190
|
-
def max_meta_entries(self) -> Optional[pulumi.Input[int]]:
|
|
1190
|
+
def max_meta_entries(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1191
1191
|
"""
|
|
1192
1192
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1193
1193
|
"""
|
|
1194
1194
|
return pulumi.get(self, "max_meta_entries")
|
|
1195
1195
|
|
|
1196
1196
|
@max_meta_entries.setter
|
|
1197
|
-
def max_meta_entries(self, value: Optional[pulumi.Input[int]]):
|
|
1197
|
+
def max_meta_entries(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1198
1198
|
pulumi.set(self, "max_meta_entries", value)
|
|
1199
1199
|
|
|
1200
|
-
@property
|
|
1200
|
+
@_builtins.property
|
|
1201
1201
|
@pulumi.getter(name="maxTimeUnreplicatedNoAcks")
|
|
1202
|
-
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[int]]:
|
|
1202
|
+
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1203
1203
|
"""
|
|
1204
1204
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1205
1205
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
@@ -1208,12 +1208,12 @@ class _IndexesState:
|
|
|
1208
1208
|
return pulumi.get(self, "max_time_unreplicated_no_acks")
|
|
1209
1209
|
|
|
1210
1210
|
@max_time_unreplicated_no_acks.setter
|
|
1211
|
-
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[int]]):
|
|
1211
|
+
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1212
1212
|
pulumi.set(self, "max_time_unreplicated_no_acks", value)
|
|
1213
1213
|
|
|
1214
|
-
@property
|
|
1214
|
+
@_builtins.property
|
|
1215
1215
|
@pulumi.getter(name="maxTimeUnreplicatedWithAcks")
|
|
1216
|
-
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[int]]:
|
|
1216
|
+
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1217
1217
|
"""
|
|
1218
1218
|
Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1219
1219
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
@@ -1222,36 +1222,36 @@ class _IndexesState:
|
|
|
1222
1222
|
return pulumi.get(self, "max_time_unreplicated_with_acks")
|
|
1223
1223
|
|
|
1224
1224
|
@max_time_unreplicated_with_acks.setter
|
|
1225
|
-
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[int]]):
|
|
1225
|
+
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1226
1226
|
pulumi.set(self, "max_time_unreplicated_with_acks", value)
|
|
1227
1227
|
|
|
1228
|
-
@property
|
|
1228
|
+
@_builtins.property
|
|
1229
1229
|
@pulumi.getter(name="maxTotalDataSizeMb")
|
|
1230
|
-
def max_total_data_size_mb(self) -> Optional[pulumi.Input[int]]:
|
|
1230
|
+
def max_total_data_size_mb(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1231
1231
|
"""
|
|
1232
1232
|
The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1233
1233
|
"""
|
|
1234
1234
|
return pulumi.get(self, "max_total_data_size_mb")
|
|
1235
1235
|
|
|
1236
1236
|
@max_total_data_size_mb.setter
|
|
1237
|
-
def max_total_data_size_mb(self, value: Optional[pulumi.Input[int]]):
|
|
1237
|
+
def max_total_data_size_mb(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1238
1238
|
pulumi.set(self, "max_total_data_size_mb", value)
|
|
1239
1239
|
|
|
1240
|
-
@property
|
|
1240
|
+
@_builtins.property
|
|
1241
1241
|
@pulumi.getter(name="maxWarmDbCount")
|
|
1242
|
-
def max_warm_db_count(self) -> Optional[pulumi.Input[int]]:
|
|
1242
|
+
def max_warm_db_count(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1243
1243
|
"""
|
|
1244
1244
|
The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1245
1245
|
"""
|
|
1246
1246
|
return pulumi.get(self, "max_warm_db_count")
|
|
1247
1247
|
|
|
1248
1248
|
@max_warm_db_count.setter
|
|
1249
|
-
def max_warm_db_count(self, value: Optional[pulumi.Input[int]]):
|
|
1249
|
+
def max_warm_db_count(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1250
1250
|
pulumi.set(self, "max_warm_db_count", value)
|
|
1251
1251
|
|
|
1252
|
-
@property
|
|
1252
|
+
@_builtins.property
|
|
1253
1253
|
@pulumi.getter(name="minRawFileSyncSecs")
|
|
1254
|
-
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[str]]:
|
|
1254
|
+
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1255
1255
|
"""
|
|
1256
1256
|
Specify an integer (or "disable") for this parameter.
|
|
1257
1257
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
@@ -1261,36 +1261,36 @@ class _IndexesState:
|
|
|
1261
1261
|
return pulumi.get(self, "min_raw_file_sync_secs")
|
|
1262
1262
|
|
|
1263
1263
|
@min_raw_file_sync_secs.setter
|
|
1264
|
-
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[str]]):
|
|
1264
|
+
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1265
1265
|
pulumi.set(self, "min_raw_file_sync_secs", value)
|
|
1266
1266
|
|
|
1267
|
-
@property
|
|
1267
|
+
@_builtins.property
|
|
1268
1268
|
@pulumi.getter(name="minStreamGroupQueueSize")
|
|
1269
|
-
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[int]]:
|
|
1269
|
+
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1270
1270
|
"""
|
|
1271
1271
|
Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1272
1272
|
"""
|
|
1273
1273
|
return pulumi.get(self, "min_stream_group_queue_size")
|
|
1274
1274
|
|
|
1275
1275
|
@min_stream_group_queue_size.setter
|
|
1276
|
-
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[int]]):
|
|
1276
|
+
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1277
1277
|
pulumi.set(self, "min_stream_group_queue_size", value)
|
|
1278
1278
|
|
|
1279
|
-
@property
|
|
1279
|
+
@_builtins.property
|
|
1280
1280
|
@pulumi.getter
|
|
1281
|
-
def name(self) -> Optional[pulumi.Input[str]]:
|
|
1281
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1282
1282
|
"""
|
|
1283
1283
|
The name of the index to create.
|
|
1284
1284
|
"""
|
|
1285
1285
|
return pulumi.get(self, "name")
|
|
1286
1286
|
|
|
1287
1287
|
@name.setter
|
|
1288
|
-
def name(self, value: Optional[pulumi.Input[str]]):
|
|
1288
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1289
1289
|
pulumi.set(self, "name", value)
|
|
1290
1290
|
|
|
1291
|
-
@property
|
|
1291
|
+
@_builtins.property
|
|
1292
1292
|
@pulumi.getter(name="partialServiceMetaPeriod")
|
|
1293
|
-
def partial_service_meta_period(self) -> Optional[pulumi.Input[int]]:
|
|
1293
|
+
def partial_service_meta_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1294
1294
|
"""
|
|
1295
1295
|
Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1296
1296
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
@@ -1300,12 +1300,12 @@ class _IndexesState:
|
|
|
1300
1300
|
return pulumi.get(self, "partial_service_meta_period")
|
|
1301
1301
|
|
|
1302
1302
|
@partial_service_meta_period.setter
|
|
1303
|
-
def partial_service_meta_period(self, value: Optional[pulumi.Input[int]]):
|
|
1303
|
+
def partial_service_meta_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1304
1304
|
pulumi.set(self, "partial_service_meta_period", value)
|
|
1305
1305
|
|
|
1306
|
-
@property
|
|
1306
|
+
@_builtins.property
|
|
1307
1307
|
@pulumi.getter(name="processTrackerServiceInterval")
|
|
1308
|
-
def process_tracker_service_interval(self) -> Optional[pulumi.Input[int]]:
|
|
1308
|
+
def process_tracker_service_interval(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1309
1309
|
"""
|
|
1310
1310
|
Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1311
1311
|
If set to 0, the indexer checks child process status every second.
|
|
@@ -1314,12 +1314,12 @@ class _IndexesState:
|
|
|
1314
1314
|
return pulumi.get(self, "process_tracker_service_interval")
|
|
1315
1315
|
|
|
1316
1316
|
@process_tracker_service_interval.setter
|
|
1317
|
-
def process_tracker_service_interval(self, value: Optional[pulumi.Input[int]]):
|
|
1317
|
+
def process_tracker_service_interval(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1318
1318
|
pulumi.set(self, "process_tracker_service_interval", value)
|
|
1319
1319
|
|
|
1320
|
-
@property
|
|
1320
|
+
@_builtins.property
|
|
1321
1321
|
@pulumi.getter(name="quarantineFutureSecs")
|
|
1322
|
-
def quarantine_future_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1322
|
+
def quarantine_future_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1323
1323
|
"""
|
|
1324
1324
|
Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1325
1325
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
@@ -1327,36 +1327,36 @@ class _IndexesState:
|
|
|
1327
1327
|
return pulumi.get(self, "quarantine_future_secs")
|
|
1328
1328
|
|
|
1329
1329
|
@quarantine_future_secs.setter
|
|
1330
|
-
def quarantine_future_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1330
|
+
def quarantine_future_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1331
1331
|
pulumi.set(self, "quarantine_future_secs", value)
|
|
1332
1332
|
|
|
1333
|
-
@property
|
|
1333
|
+
@_builtins.property
|
|
1334
1334
|
@pulumi.getter(name="quarantinePastSecs")
|
|
1335
|
-
def quarantine_past_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1335
|
+
def quarantine_past_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1336
1336
|
"""
|
|
1337
1337
|
Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1338
1338
|
"""
|
|
1339
1339
|
return pulumi.get(self, "quarantine_past_secs")
|
|
1340
1340
|
|
|
1341
1341
|
@quarantine_past_secs.setter
|
|
1342
|
-
def quarantine_past_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1342
|
+
def quarantine_past_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1343
1343
|
pulumi.set(self, "quarantine_past_secs", value)
|
|
1344
1344
|
|
|
1345
|
-
@property
|
|
1345
|
+
@_builtins.property
|
|
1346
1346
|
@pulumi.getter(name="rawChunkSizeBytes")
|
|
1347
|
-
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[int]]:
|
|
1347
|
+
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1348
1348
|
"""
|
|
1349
1349
|
Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1350
1350
|
"""
|
|
1351
1351
|
return pulumi.get(self, "raw_chunk_size_bytes")
|
|
1352
1352
|
|
|
1353
1353
|
@raw_chunk_size_bytes.setter
|
|
1354
|
-
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[int]]):
|
|
1354
|
+
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1355
1355
|
pulumi.set(self, "raw_chunk_size_bytes", value)
|
|
1356
1356
|
|
|
1357
|
-
@property
|
|
1357
|
+
@_builtins.property
|
|
1358
1358
|
@pulumi.getter(name="repFactor")
|
|
1359
|
-
def rep_factor(self) -> Optional[pulumi.Input[str]]:
|
|
1359
|
+
def rep_factor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1360
1360
|
"""
|
|
1361
1361
|
Index replication control. This parameter applies to only clustering slaves.
|
|
1362
1362
|
auto = Use the master index replication configuration value.
|
|
@@ -1365,24 +1365,24 @@ class _IndexesState:
|
|
|
1365
1365
|
return pulumi.get(self, "rep_factor")
|
|
1366
1366
|
|
|
1367
1367
|
@rep_factor.setter
|
|
1368
|
-
def rep_factor(self, value: Optional[pulumi.Input[str]]):
|
|
1368
|
+
def rep_factor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1369
1369
|
pulumi.set(self, "rep_factor", value)
|
|
1370
1370
|
|
|
1371
|
-
@property
|
|
1371
|
+
@_builtins.property
|
|
1372
1372
|
@pulumi.getter(name="rotatePeriodInSecs")
|
|
1373
|
-
def rotate_period_in_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1373
|
+
def rotate_period_in_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1374
1374
|
"""
|
|
1375
1375
|
How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1376
1376
|
"""
|
|
1377
1377
|
return pulumi.get(self, "rotate_period_in_secs")
|
|
1378
1378
|
|
|
1379
1379
|
@rotate_period_in_secs.setter
|
|
1380
|
-
def rotate_period_in_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1380
|
+
def rotate_period_in_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1381
1381
|
pulumi.set(self, "rotate_period_in_secs", value)
|
|
1382
1382
|
|
|
1383
|
-
@property
|
|
1383
|
+
@_builtins.property
|
|
1384
1384
|
@pulumi.getter(name="serviceMetaPeriod")
|
|
1385
|
-
def service_meta_period(self) -> Optional[pulumi.Input[int]]:
|
|
1385
|
+
def service_meta_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1386
1386
|
"""
|
|
1387
1387
|
Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1388
1388
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
@@ -1390,24 +1390,24 @@ class _IndexesState:
|
|
|
1390
1390
|
return pulumi.get(self, "service_meta_period")
|
|
1391
1391
|
|
|
1392
1392
|
@service_meta_period.setter
|
|
1393
|
-
def service_meta_period(self, value: Optional[pulumi.Input[int]]):
|
|
1393
|
+
def service_meta_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1394
1394
|
pulumi.set(self, "service_meta_period", value)
|
|
1395
1395
|
|
|
1396
|
-
@property
|
|
1396
|
+
@_builtins.property
|
|
1397
1397
|
@pulumi.getter(name="syncMeta")
|
|
1398
|
-
def sync_meta(self) -> Optional[pulumi.Input[bool]]:
|
|
1398
|
+
def sync_meta(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1399
1399
|
"""
|
|
1400
1400
|
When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1401
1401
|
"""
|
|
1402
1402
|
return pulumi.get(self, "sync_meta")
|
|
1403
1403
|
|
|
1404
1404
|
@sync_meta.setter
|
|
1405
|
-
def sync_meta(self, value: Optional[pulumi.Input[bool]]):
|
|
1405
|
+
def sync_meta(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1406
1406
|
pulumi.set(self, "sync_meta", value)
|
|
1407
1407
|
|
|
1408
|
-
@property
|
|
1408
|
+
@_builtins.property
|
|
1409
1409
|
@pulumi.getter(name="thawedPath")
|
|
1410
|
-
def thawed_path(self) -> Optional[pulumi.Input[str]]:
|
|
1410
|
+
def thawed_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1411
1411
|
"""
|
|
1412
1412
|
An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1413
1413
|
Cannot be defined in terms of a volume definition.
|
|
@@ -1416,24 +1416,24 @@ class _IndexesState:
|
|
|
1416
1416
|
return pulumi.get(self, "thawed_path")
|
|
1417
1417
|
|
|
1418
1418
|
@thawed_path.setter
|
|
1419
|
-
def thawed_path(self, value: Optional[pulumi.Input[str]]):
|
|
1419
|
+
def thawed_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1420
1420
|
pulumi.set(self, "thawed_path", value)
|
|
1421
1421
|
|
|
1422
|
-
@property
|
|
1422
|
+
@_builtins.property
|
|
1423
1423
|
@pulumi.getter(name="throttleCheckPeriod")
|
|
1424
|
-
def throttle_check_period(self) -> Optional[pulumi.Input[int]]:
|
|
1424
|
+
def throttle_check_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1425
1425
|
"""
|
|
1426
1426
|
Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1427
1427
|
"""
|
|
1428
1428
|
return pulumi.get(self, "throttle_check_period")
|
|
1429
1429
|
|
|
1430
1430
|
@throttle_check_period.setter
|
|
1431
|
-
def throttle_check_period(self, value: Optional[pulumi.Input[int]]):
|
|
1431
|
+
def throttle_check_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1432
1432
|
pulumi.set(self, "throttle_check_period", value)
|
|
1433
1433
|
|
|
1434
|
-
@property
|
|
1434
|
+
@_builtins.property
|
|
1435
1435
|
@pulumi.getter(name="tstatsHomePath")
|
|
1436
|
-
def tstats_home_path(self) -> Optional[pulumi.Input[str]]:
|
|
1436
|
+
def tstats_home_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1437
1437
|
"""
|
|
1438
1438
|
Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1439
1439
|
If specified, it must be defined in terms of a volume definition.
|
|
@@ -1441,12 +1441,12 @@ class _IndexesState:
|
|
|
1441
1441
|
return pulumi.get(self, "tstats_home_path")
|
|
1442
1442
|
|
|
1443
1443
|
@tstats_home_path.setter
|
|
1444
|
-
def tstats_home_path(self, value: Optional[pulumi.Input[str]]):
|
|
1444
|
+
def tstats_home_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1445
1445
|
pulumi.set(self, "tstats_home_path", value)
|
|
1446
1446
|
|
|
1447
|
-
@property
|
|
1447
|
+
@_builtins.property
|
|
1448
1448
|
@pulumi.getter(name="warmToColdScript")
|
|
1449
|
-
def warm_to_cold_script(self) -> Optional[pulumi.Input[str]]:
|
|
1449
|
+
def warm_to_cold_script(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1450
1450
|
"""
|
|
1451
1451
|
Path to a script to run when moving data from warm to cold.
|
|
1452
1452
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
@@ -1454,54 +1454,55 @@ class _IndexesState:
|
|
|
1454
1454
|
return pulumi.get(self, "warm_to_cold_script")
|
|
1455
1455
|
|
|
1456
1456
|
@warm_to_cold_script.setter
|
|
1457
|
-
def warm_to_cold_script(self, value: Optional[pulumi.Input[str]]):
|
|
1457
|
+
def warm_to_cold_script(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1458
1458
|
pulumi.set(self, "warm_to_cold_script", value)
|
|
1459
1459
|
|
|
1460
1460
|
|
|
1461
|
+
@pulumi.type_token("splunk:index/indexes:Indexes")
|
|
1461
1462
|
class Indexes(pulumi.CustomResource):
|
|
1462
1463
|
@overload
|
|
1463
1464
|
def __init__(__self__,
|
|
1464
1465
|
resource_name: str,
|
|
1465
1466
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1466
1467
|
acl: Optional[pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']]] = None,
|
|
1467
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
1468
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
1469
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
1470
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
1471
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
1472
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
1473
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
1474
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
1475
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1476
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
1477
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
1478
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
1479
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
1480
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
1481
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
1482
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
1483
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
1484
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
1485
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
1486
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
1487
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
1488
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
1489
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
1490
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
1491
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
1492
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1493
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
1494
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
1495
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
1496
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
1497
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
1498
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1499
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1500
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
1501
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
1502
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
1503
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
1504
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None,
|
|
1468
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1469
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1470
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1471
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1472
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1473
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1474
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1475
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1476
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1477
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1478
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1479
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1480
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1481
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1482
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1483
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1484
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1485
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1486
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1487
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1488
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1489
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1490
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1491
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1492
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1493
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1494
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1495
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1496
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1497
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1498
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1499
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1500
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1501
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1502
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1503
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1504
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1505
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1505
1506
|
__props__=None):
|
|
1506
1507
|
"""
|
|
1507
1508
|
## # Resource: Indexes
|
|
@@ -1528,16 +1529,16 @@ class Indexes(pulumi.CustomResource):
|
|
|
1528
1529
|
:param str resource_name: The name of the resource.
|
|
1529
1530
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1530
1531
|
:param pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']] acl: The app/user context that is the namespace for the resource
|
|
1531
|
-
:param pulumi.Input[int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1532
|
-
:param pulumi.Input[str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1532
|
+
:param pulumi.Input[_builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1533
|
+
:param pulumi.Input[_builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1533
1534
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
1534
1535
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
1535
1536
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
1536
1537
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
1537
1538
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
1538
1539
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
1539
|
-
:param pulumi.Input[str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1540
|
-
:param pulumi.Input[str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1540
|
+
:param pulumi.Input[_builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1541
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1541
1542
|
<br>
|
|
1542
1543
|
Bucket freezing policy is as follows:<br>
|
|
1543
1544
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -1545,70 +1546,70 @@ class Indexes(pulumi.CustomResource):
|
|
|
1545
1546
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
1546
1547
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
1547
1548
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
1548
|
-
:param pulumi.Input[str] cold_to_frozen_script: Path to the archiving script.
|
|
1549
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
1549
1550
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
1550
1551
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
1551
1552
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
1552
|
-
:param pulumi.Input[bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1553
|
-
:param pulumi.Input[str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1554
|
-
:param pulumi.Input[bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1553
|
+
:param pulumi.Input[_builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1554
|
+
:param pulumi.Input[_builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1555
|
+
:param pulumi.Input[_builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1555
1556
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
1556
|
-
:param pulumi.Input[int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1557
|
+
:param pulumi.Input[_builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1557
1558
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
1558
|
-
:param pulumi.Input[str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1559
|
+
:param pulumi.Input[_builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1559
1560
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
1560
1561
|
<br>Caution: The path must be readable and writable.
|
|
1561
|
-
:param pulumi.Input[str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1562
|
+
:param pulumi.Input[_builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1562
1563
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
1563
|
-
:param pulumi.Input[int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1564
|
+
:param pulumi.Input[_builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1564
1565
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
1565
|
-
:param pulumi.Input[str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1566
|
+
:param pulumi.Input[_builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1566
1567
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
1567
|
-
:param pulumi.Input[int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1568
|
+
:param pulumi.Input[_builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1568
1569
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
1569
|
-
:param pulumi.Input[int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1570
|
-
:param pulumi.Input[int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1571
|
-
:param pulumi.Input[int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1572
|
-
:param pulumi.Input[int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1573
|
-
:param pulumi.Input[int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1570
|
+
:param pulumi.Input[_builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1571
|
+
:param pulumi.Input[_builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1572
|
+
:param pulumi.Input[_builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1573
|
+
:param pulumi.Input[_builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1574
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1574
1575
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
1575
1576
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1576
|
-
:param pulumi.Input[int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1577
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1577
1578
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
1578
1579
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
1579
|
-
:param pulumi.Input[int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1580
|
-
:param pulumi.Input[int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1581
|
-
:param pulumi.Input[str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1580
|
+
:param pulumi.Input[_builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1581
|
+
:param pulumi.Input[_builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1582
|
+
:param pulumi.Input[_builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1582
1583
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
1583
1584
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
1584
1585
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
1585
|
-
:param pulumi.Input[int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1586
|
-
:param pulumi.Input[str] name: The name of the index to create.
|
|
1587
|
-
:param pulumi.Input[int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1586
|
+
:param pulumi.Input[_builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1587
|
+
:param pulumi.Input[_builtins.str] name: The name of the index to create.
|
|
1588
|
+
:param pulumi.Input[_builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1588
1589
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
1589
1590
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
1590
1591
|
By default it is turned off (zero).
|
|
1591
|
-
:param pulumi.Input[int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1592
|
+
:param pulumi.Input[_builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1592
1593
|
If set to 0, the indexer checks child process status every second.
|
|
1593
1594
|
Highest legal value is 4294967295.
|
|
1594
|
-
:param pulumi.Input[int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1595
|
+
:param pulumi.Input[_builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1595
1596
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
1596
|
-
:param pulumi.Input[int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1597
|
-
:param pulumi.Input[int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1598
|
-
:param pulumi.Input[str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1597
|
+
:param pulumi.Input[_builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1598
|
+
:param pulumi.Input[_builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1599
|
+
:param pulumi.Input[_builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1599
1600
|
auto = Use the master index replication configuration value.
|
|
1600
1601
|
0 = Turn off replication for this index.
|
|
1601
|
-
:param pulumi.Input[int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1602
|
-
:param pulumi.Input[int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1602
|
+
:param pulumi.Input[_builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1603
|
+
:param pulumi.Input[_builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1603
1604
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
1604
|
-
:param pulumi.Input[bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1605
|
-
:param pulumi.Input[str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1605
|
+
:param pulumi.Input[_builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1606
|
+
:param pulumi.Input[_builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1606
1607
|
Cannot be defined in terms of a volume definition.
|
|
1607
1608
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
1608
|
-
:param pulumi.Input[int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1609
|
-
:param pulumi.Input[str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1609
|
+
:param pulumi.Input[_builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1610
|
+
:param pulumi.Input[_builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1610
1611
|
If specified, it must be defined in terms of a volume definition.
|
|
1611
|
-
:param pulumi.Input[str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1612
|
+
:param pulumi.Input[_builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1612
1613
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
1613
1614
|
"""
|
|
1614
1615
|
...
|
|
@@ -1655,44 +1656,44 @@ class Indexes(pulumi.CustomResource):
|
|
|
1655
1656
|
resource_name: str,
|
|
1656
1657
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1657
1658
|
acl: Optional[pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']]] = None,
|
|
1658
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
1659
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
1660
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
1661
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
1662
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
1663
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
1664
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
1665
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
1666
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1667
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
1668
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
1669
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
1670
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
1671
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
1672
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
1673
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
1674
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
1675
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
1676
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
1677
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
1678
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
1679
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
1680
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
1681
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
1682
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
1683
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1684
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
1685
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
1686
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
1687
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
1688
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
1689
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1690
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1691
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
1692
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
1693
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
1694
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
1695
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None,
|
|
1659
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1660
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1661
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1662
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1663
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1664
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1665
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1666
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1667
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1668
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1669
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1670
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1671
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1672
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1673
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1674
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1675
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1676
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1677
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1678
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1679
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1680
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1681
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1682
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1683
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1684
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1685
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1686
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1687
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1688
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1689
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1690
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1691
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1692
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1693
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1694
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1695
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1696
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1696
1697
|
__props__=None):
|
|
1697
1698
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
1698
1699
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -1752,44 +1753,44 @@ class Indexes(pulumi.CustomResource):
|
|
|
1752
1753
|
id: pulumi.Input[str],
|
|
1753
1754
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1754
1755
|
acl: Optional[pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']]] = None,
|
|
1755
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
1756
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
1757
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
1758
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
1759
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
1760
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
1761
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
1762
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
1763
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1764
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
1765
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
1766
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
1767
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
1768
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
1769
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
1770
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
1771
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
1772
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
1773
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
1774
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
1775
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
1776
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
1777
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
1778
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
1779
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
1780
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1781
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
1782
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
1783
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
1784
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
1785
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
1786
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1787
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1788
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
1789
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
1790
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
1791
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
1792
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None) -> 'Indexes':
|
|
1756
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1757
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1758
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1759
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1760
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1761
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1762
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1763
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1764
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1765
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1766
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1767
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1768
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1769
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1770
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1771
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1772
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1773
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1774
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1775
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1776
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1777
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1778
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1779
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1780
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1781
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1782
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1783
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1784
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1785
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1786
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1787
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1788
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1789
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1790
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1791
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1792
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1793
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None) -> 'Indexes':
|
|
1793
1794
|
"""
|
|
1794
1795
|
Get an existing Indexes resource's state with the given name, id, and optional extra
|
|
1795
1796
|
properties used to qualify the lookup.
|
|
@@ -1798,16 +1799,16 @@ class Indexes(pulumi.CustomResource):
|
|
|
1798
1799
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
1799
1800
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1800
1801
|
:param pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']] acl: The app/user context that is the namespace for the resource
|
|
1801
|
-
:param pulumi.Input[int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1802
|
-
:param pulumi.Input[str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1802
|
+
:param pulumi.Input[_builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1803
|
+
:param pulumi.Input[_builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1803
1804
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
1804
1805
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
1805
1806
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
1806
1807
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
1807
1808
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
1808
1809
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
1809
|
-
:param pulumi.Input[str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1810
|
-
:param pulumi.Input[str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1810
|
+
:param pulumi.Input[_builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1811
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1811
1812
|
<br>
|
|
1812
1813
|
Bucket freezing policy is as follows:<br>
|
|
1813
1814
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -1815,70 +1816,70 @@ class Indexes(pulumi.CustomResource):
|
|
|
1815
1816
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
1816
1817
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
1817
1818
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
1818
|
-
:param pulumi.Input[str] cold_to_frozen_script: Path to the archiving script.
|
|
1819
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
1819
1820
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
1820
1821
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
1821
1822
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
1822
|
-
:param pulumi.Input[bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1823
|
-
:param pulumi.Input[str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1824
|
-
:param pulumi.Input[bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1823
|
+
:param pulumi.Input[_builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1824
|
+
:param pulumi.Input[_builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1825
|
+
:param pulumi.Input[_builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1825
1826
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
1826
|
-
:param pulumi.Input[int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1827
|
+
:param pulumi.Input[_builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1827
1828
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
1828
|
-
:param pulumi.Input[str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1829
|
+
:param pulumi.Input[_builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1829
1830
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
1830
1831
|
<br>Caution: The path must be readable and writable.
|
|
1831
|
-
:param pulumi.Input[str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1832
|
+
:param pulumi.Input[_builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1832
1833
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
1833
|
-
:param pulumi.Input[int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1834
|
+
:param pulumi.Input[_builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1834
1835
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
1835
|
-
:param pulumi.Input[str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1836
|
+
:param pulumi.Input[_builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1836
1837
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
1837
|
-
:param pulumi.Input[int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1838
|
+
:param pulumi.Input[_builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1838
1839
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
1839
|
-
:param pulumi.Input[int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1840
|
-
:param pulumi.Input[int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1841
|
-
:param pulumi.Input[int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1842
|
-
:param pulumi.Input[int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1843
|
-
:param pulumi.Input[int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1840
|
+
:param pulumi.Input[_builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1841
|
+
:param pulumi.Input[_builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1842
|
+
:param pulumi.Input[_builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1843
|
+
:param pulumi.Input[_builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1844
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1844
1845
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
1845
1846
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1846
|
-
:param pulumi.Input[int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1847
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1847
1848
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
1848
1849
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
1849
|
-
:param pulumi.Input[int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1850
|
-
:param pulumi.Input[int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1851
|
-
:param pulumi.Input[str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1850
|
+
:param pulumi.Input[_builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1851
|
+
:param pulumi.Input[_builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1852
|
+
:param pulumi.Input[_builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1852
1853
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
1853
1854
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
1854
1855
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
1855
|
-
:param pulumi.Input[int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1856
|
-
:param pulumi.Input[str] name: The name of the index to create.
|
|
1857
|
-
:param pulumi.Input[int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1856
|
+
:param pulumi.Input[_builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1857
|
+
:param pulumi.Input[_builtins.str] name: The name of the index to create.
|
|
1858
|
+
:param pulumi.Input[_builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1858
1859
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
1859
1860
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
1860
1861
|
By default it is turned off (zero).
|
|
1861
|
-
:param pulumi.Input[int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1862
|
+
:param pulumi.Input[_builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1862
1863
|
If set to 0, the indexer checks child process status every second.
|
|
1863
1864
|
Highest legal value is 4294967295.
|
|
1864
|
-
:param pulumi.Input[int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1865
|
+
:param pulumi.Input[_builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1865
1866
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
1866
|
-
:param pulumi.Input[int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1867
|
-
:param pulumi.Input[int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1868
|
-
:param pulumi.Input[str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1867
|
+
:param pulumi.Input[_builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1868
|
+
:param pulumi.Input[_builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1869
|
+
:param pulumi.Input[_builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1869
1870
|
auto = Use the master index replication configuration value.
|
|
1870
1871
|
0 = Turn off replication for this index.
|
|
1871
|
-
:param pulumi.Input[int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1872
|
-
:param pulumi.Input[int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1872
|
+
:param pulumi.Input[_builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1873
|
+
:param pulumi.Input[_builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1873
1874
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
1874
|
-
:param pulumi.Input[bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1875
|
-
:param pulumi.Input[str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1875
|
+
:param pulumi.Input[_builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1876
|
+
:param pulumi.Input[_builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1876
1877
|
Cannot be defined in terms of a volume definition.
|
|
1877
1878
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
1878
|
-
:param pulumi.Input[int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1879
|
-
:param pulumi.Input[str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1879
|
+
:param pulumi.Input[_builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1880
|
+
:param pulumi.Input[_builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1880
1881
|
If specified, it must be defined in terms of a volume definition.
|
|
1881
|
-
:param pulumi.Input[str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1882
|
+
:param pulumi.Input[_builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1882
1883
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
1883
1884
|
"""
|
|
1884
1885
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
@@ -1926,7 +1927,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
1926
1927
|
__props__.__dict__["warm_to_cold_script"] = warm_to_cold_script
|
|
1927
1928
|
return Indexes(resource_name, opts=opts, __props__=__props__)
|
|
1928
1929
|
|
|
1929
|
-
@property
|
|
1930
|
+
@_builtins.property
|
|
1930
1931
|
@pulumi.getter
|
|
1931
1932
|
def acl(self) -> pulumi.Output['outputs.IndexesAcl']:
|
|
1932
1933
|
"""
|
|
@@ -1934,17 +1935,17 @@ class Indexes(pulumi.CustomResource):
|
|
|
1934
1935
|
"""
|
|
1935
1936
|
return pulumi.get(self, "acl")
|
|
1936
1937
|
|
|
1937
|
-
@property
|
|
1938
|
+
@_builtins.property
|
|
1938
1939
|
@pulumi.getter(name="blockSignSize")
|
|
1939
|
-
def block_sign_size(self) -> pulumi.Output[int]:
|
|
1940
|
+
def block_sign_size(self) -> pulumi.Output[_builtins.int]:
|
|
1940
1941
|
"""
|
|
1941
1942
|
Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1942
1943
|
"""
|
|
1943
1944
|
return pulumi.get(self, "block_sign_size")
|
|
1944
1945
|
|
|
1945
|
-
@property
|
|
1946
|
+
@_builtins.property
|
|
1946
1947
|
@pulumi.getter(name="bucketRebuildMemoryHint")
|
|
1947
|
-
def bucket_rebuild_memory_hint(self) -> pulumi.Output[str]:
|
|
1948
|
+
def bucket_rebuild_memory_hint(self) -> pulumi.Output[_builtins.str]:
|
|
1948
1949
|
"""
|
|
1949
1950
|
Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1950
1951
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
@@ -1956,17 +1957,17 @@ class Indexes(pulumi.CustomResource):
|
|
|
1956
1957
|
"""
|
|
1957
1958
|
return pulumi.get(self, "bucket_rebuild_memory_hint")
|
|
1958
1959
|
|
|
1959
|
-
@property
|
|
1960
|
+
@_builtins.property
|
|
1960
1961
|
@pulumi.getter(name="coldPath")
|
|
1961
|
-
def cold_path(self) -> pulumi.Output[str]:
|
|
1962
|
+
def cold_path(self) -> pulumi.Output[_builtins.str]:
|
|
1962
1963
|
"""
|
|
1963
1964
|
An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1964
1965
|
"""
|
|
1965
1966
|
return pulumi.get(self, "cold_path")
|
|
1966
1967
|
|
|
1967
|
-
@property
|
|
1968
|
+
@_builtins.property
|
|
1968
1969
|
@pulumi.getter(name="coldToFrozenDir")
|
|
1969
|
-
def cold_to_frozen_dir(self) -> pulumi.Output[str]:
|
|
1970
|
+
def cold_to_frozen_dir(self) -> pulumi.Output[_builtins.str]:
|
|
1970
1971
|
"""
|
|
1971
1972
|
Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1972
1973
|
<br>
|
|
@@ -1979,9 +1980,9 @@ class Indexes(pulumi.CustomResource):
|
|
|
1979
1980
|
"""
|
|
1980
1981
|
return pulumi.get(self, "cold_to_frozen_dir")
|
|
1981
1982
|
|
|
1982
|
-
@property
|
|
1983
|
+
@_builtins.property
|
|
1983
1984
|
@pulumi.getter(name="coldToFrozenScript")
|
|
1984
|
-
def cold_to_frozen_script(self) -> pulumi.Output[str]:
|
|
1985
|
+
def cold_to_frozen_script(self) -> pulumi.Output[_builtins.str]:
|
|
1985
1986
|
"""
|
|
1986
1987
|
Path to the archiving script.
|
|
1987
1988
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
@@ -1990,43 +1991,43 @@ class Indexes(pulumi.CustomResource):
|
|
|
1990
1991
|
"""
|
|
1991
1992
|
return pulumi.get(self, "cold_to_frozen_script")
|
|
1992
1993
|
|
|
1993
|
-
@property
|
|
1994
|
+
@_builtins.property
|
|
1994
1995
|
@pulumi.getter(name="compressRawdata")
|
|
1995
|
-
def compress_rawdata(self) -> pulumi.Output[bool]:
|
|
1996
|
+
def compress_rawdata(self) -> pulumi.Output[_builtins.bool]:
|
|
1996
1997
|
"""
|
|
1997
1998
|
This parameter is ignored. The splunkd process always compresses raw data.
|
|
1998
1999
|
"""
|
|
1999
2000
|
return pulumi.get(self, "compress_rawdata")
|
|
2000
2001
|
|
|
2001
|
-
@property
|
|
2002
|
+
@_builtins.property
|
|
2002
2003
|
@pulumi.getter
|
|
2003
|
-
def datatype(self) -> pulumi.Output[str]:
|
|
2004
|
+
def datatype(self) -> pulumi.Output[_builtins.str]:
|
|
2004
2005
|
"""
|
|
2005
2006
|
Valid values: (event | metric). Specifies the type of index.
|
|
2006
2007
|
"""
|
|
2007
2008
|
return pulumi.get(self, "datatype")
|
|
2008
2009
|
|
|
2009
|
-
@property
|
|
2010
|
+
@_builtins.property
|
|
2010
2011
|
@pulumi.getter(name="enableOnlineBucketRepair")
|
|
2011
|
-
def enable_online_bucket_repair(self) -> pulumi.Output[bool]:
|
|
2012
|
+
def enable_online_bucket_repair(self) -> pulumi.Output[_builtins.bool]:
|
|
2012
2013
|
"""
|
|
2013
2014
|
Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
2014
2015
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
2015
2016
|
"""
|
|
2016
2017
|
return pulumi.get(self, "enable_online_bucket_repair")
|
|
2017
2018
|
|
|
2018
|
-
@property
|
|
2019
|
+
@_builtins.property
|
|
2019
2020
|
@pulumi.getter(name="frozenTimePeriodInSecs")
|
|
2020
|
-
def frozen_time_period_in_secs(self) -> pulumi.Output[int]:
|
|
2021
|
+
def frozen_time_period_in_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2021
2022
|
"""
|
|
2022
2023
|
Number of seconds after which indexed data rolls to frozen.
|
|
2023
2024
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
2024
2025
|
"""
|
|
2025
2026
|
return pulumi.get(self, "frozen_time_period_in_secs")
|
|
2026
2027
|
|
|
2027
|
-
@property
|
|
2028
|
+
@_builtins.property
|
|
2028
2029
|
@pulumi.getter(name="homePath")
|
|
2029
|
-
def home_path(self) -> pulumi.Output[str]:
|
|
2030
|
+
def home_path(self) -> pulumi.Output[_builtins.str]:
|
|
2030
2031
|
"""
|
|
2031
2032
|
An absolute path that contains the hot and warm buckets for the index.
|
|
2032
2033
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
@@ -2034,77 +2035,77 @@ class Indexes(pulumi.CustomResource):
|
|
|
2034
2035
|
"""
|
|
2035
2036
|
return pulumi.get(self, "home_path")
|
|
2036
2037
|
|
|
2037
|
-
@property
|
|
2038
|
+
@_builtins.property
|
|
2038
2039
|
@pulumi.getter(name="maxBloomBackfillBucketAge")
|
|
2039
|
-
def max_bloom_backfill_bucket_age(self) -> pulumi.Output[str]:
|
|
2040
|
+
def max_bloom_backfill_bucket_age(self) -> pulumi.Output[_builtins.str]:
|
|
2040
2041
|
"""
|
|
2041
2042
|
Valid values are: Integer[m|s|h|d].
|
|
2042
2043
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
2043
2044
|
"""
|
|
2044
2045
|
return pulumi.get(self, "max_bloom_backfill_bucket_age")
|
|
2045
2046
|
|
|
2046
|
-
@property
|
|
2047
|
+
@_builtins.property
|
|
2047
2048
|
@pulumi.getter(name="maxConcurrentOptimizes")
|
|
2048
|
-
def max_concurrent_optimizes(self) -> pulumi.Output[int]:
|
|
2049
|
+
def max_concurrent_optimizes(self) -> pulumi.Output[_builtins.int]:
|
|
2049
2050
|
"""
|
|
2050
2051
|
The number of concurrent optimize processes that can run against a hot bucket.
|
|
2051
2052
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
2052
2053
|
"""
|
|
2053
2054
|
return pulumi.get(self, "max_concurrent_optimizes")
|
|
2054
2055
|
|
|
2055
|
-
@property
|
|
2056
|
+
@_builtins.property
|
|
2056
2057
|
@pulumi.getter(name="maxDataSize")
|
|
2057
|
-
def max_data_size(self) -> pulumi.Output[str]:
|
|
2058
|
+
def max_data_size(self) -> pulumi.Output[_builtins.str]:
|
|
2058
2059
|
"""
|
|
2059
2060
|
The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
2060
2061
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
2061
2062
|
"""
|
|
2062
2063
|
return pulumi.get(self, "max_data_size")
|
|
2063
2064
|
|
|
2064
|
-
@property
|
|
2065
|
+
@_builtins.property
|
|
2065
2066
|
@pulumi.getter(name="maxHotBuckets")
|
|
2066
|
-
def max_hot_buckets(self) -> pulumi.Output[int]:
|
|
2067
|
+
def max_hot_buckets(self) -> pulumi.Output[_builtins.int]:
|
|
2067
2068
|
"""
|
|
2068
2069
|
Maximum hot buckets that can exist per index. Defaults to 3.
|
|
2069
2070
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
2070
2071
|
"""
|
|
2071
2072
|
return pulumi.get(self, "max_hot_buckets")
|
|
2072
2073
|
|
|
2073
|
-
@property
|
|
2074
|
+
@_builtins.property
|
|
2074
2075
|
@pulumi.getter(name="maxHotIdleSecs")
|
|
2075
|
-
def max_hot_idle_secs(self) -> pulumi.Output[int]:
|
|
2076
|
+
def max_hot_idle_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2076
2077
|
"""
|
|
2077
2078
|
Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
2078
2079
|
"""
|
|
2079
2080
|
return pulumi.get(self, "max_hot_idle_secs")
|
|
2080
2081
|
|
|
2081
|
-
@property
|
|
2082
|
+
@_builtins.property
|
|
2082
2083
|
@pulumi.getter(name="maxHotSpanSecs")
|
|
2083
|
-
def max_hot_span_secs(self) -> pulumi.Output[int]:
|
|
2084
|
+
def max_hot_span_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2084
2085
|
"""
|
|
2085
2086
|
Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
2086
2087
|
"""
|
|
2087
2088
|
return pulumi.get(self, "max_hot_span_secs")
|
|
2088
2089
|
|
|
2089
|
-
@property
|
|
2090
|
+
@_builtins.property
|
|
2090
2091
|
@pulumi.getter(name="maxMemMb")
|
|
2091
|
-
def max_mem_mb(self) -> pulumi.Output[int]:
|
|
2092
|
+
def max_mem_mb(self) -> pulumi.Output[_builtins.int]:
|
|
2092
2093
|
"""
|
|
2093
2094
|
The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
2094
2095
|
"""
|
|
2095
2096
|
return pulumi.get(self, "max_mem_mb")
|
|
2096
2097
|
|
|
2097
|
-
@property
|
|
2098
|
+
@_builtins.property
|
|
2098
2099
|
@pulumi.getter(name="maxMetaEntries")
|
|
2099
|
-
def max_meta_entries(self) -> pulumi.Output[int]:
|
|
2100
|
+
def max_meta_entries(self) -> pulumi.Output[_builtins.int]:
|
|
2100
2101
|
"""
|
|
2101
2102
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
2102
2103
|
"""
|
|
2103
2104
|
return pulumi.get(self, "max_meta_entries")
|
|
2104
2105
|
|
|
2105
|
-
@property
|
|
2106
|
+
@_builtins.property
|
|
2106
2107
|
@pulumi.getter(name="maxTimeUnreplicatedNoAcks")
|
|
2107
|
-
def max_time_unreplicated_no_acks(self) -> pulumi.Output[int]:
|
|
2108
|
+
def max_time_unreplicated_no_acks(self) -> pulumi.Output[_builtins.int]:
|
|
2108
2109
|
"""
|
|
2109
2110
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
2110
2111
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
@@ -2112,9 +2113,9 @@ class Indexes(pulumi.CustomResource):
|
|
|
2112
2113
|
"""
|
|
2113
2114
|
return pulumi.get(self, "max_time_unreplicated_no_acks")
|
|
2114
2115
|
|
|
2115
|
-
@property
|
|
2116
|
+
@_builtins.property
|
|
2116
2117
|
@pulumi.getter(name="maxTimeUnreplicatedWithAcks")
|
|
2117
|
-
def max_time_unreplicated_with_acks(self) -> pulumi.Output[int]:
|
|
2118
|
+
def max_time_unreplicated_with_acks(self) -> pulumi.Output[_builtins.int]:
|
|
2118
2119
|
"""
|
|
2119
2120
|
Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
2120
2121
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
@@ -2122,25 +2123,25 @@ class Indexes(pulumi.CustomResource):
|
|
|
2122
2123
|
"""
|
|
2123
2124
|
return pulumi.get(self, "max_time_unreplicated_with_acks")
|
|
2124
2125
|
|
|
2125
|
-
@property
|
|
2126
|
+
@_builtins.property
|
|
2126
2127
|
@pulumi.getter(name="maxTotalDataSizeMb")
|
|
2127
|
-
def max_total_data_size_mb(self) -> pulumi.Output[int]:
|
|
2128
|
+
def max_total_data_size_mb(self) -> pulumi.Output[_builtins.int]:
|
|
2128
2129
|
"""
|
|
2129
2130
|
The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
2130
2131
|
"""
|
|
2131
2132
|
return pulumi.get(self, "max_total_data_size_mb")
|
|
2132
2133
|
|
|
2133
|
-
@property
|
|
2134
|
+
@_builtins.property
|
|
2134
2135
|
@pulumi.getter(name="maxWarmDbCount")
|
|
2135
|
-
def max_warm_db_count(self) -> pulumi.Output[int]:
|
|
2136
|
+
def max_warm_db_count(self) -> pulumi.Output[_builtins.int]:
|
|
2136
2137
|
"""
|
|
2137
2138
|
The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
2138
2139
|
"""
|
|
2139
2140
|
return pulumi.get(self, "max_warm_db_count")
|
|
2140
2141
|
|
|
2141
|
-
@property
|
|
2142
|
+
@_builtins.property
|
|
2142
2143
|
@pulumi.getter(name="minRawFileSyncSecs")
|
|
2143
|
-
def min_raw_file_sync_secs(self) -> pulumi.Output[str]:
|
|
2144
|
+
def min_raw_file_sync_secs(self) -> pulumi.Output[_builtins.str]:
|
|
2144
2145
|
"""
|
|
2145
2146
|
Specify an integer (or "disable") for this parameter.
|
|
2146
2147
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
@@ -2149,25 +2150,25 @@ class Indexes(pulumi.CustomResource):
|
|
|
2149
2150
|
"""
|
|
2150
2151
|
return pulumi.get(self, "min_raw_file_sync_secs")
|
|
2151
2152
|
|
|
2152
|
-
@property
|
|
2153
|
+
@_builtins.property
|
|
2153
2154
|
@pulumi.getter(name="minStreamGroupQueueSize")
|
|
2154
|
-
def min_stream_group_queue_size(self) -> pulumi.Output[int]:
|
|
2155
|
+
def min_stream_group_queue_size(self) -> pulumi.Output[_builtins.int]:
|
|
2155
2156
|
"""
|
|
2156
2157
|
Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
2157
2158
|
"""
|
|
2158
2159
|
return pulumi.get(self, "min_stream_group_queue_size")
|
|
2159
2160
|
|
|
2160
|
-
@property
|
|
2161
|
+
@_builtins.property
|
|
2161
2162
|
@pulumi.getter
|
|
2162
|
-
def name(self) -> pulumi.Output[str]:
|
|
2163
|
+
def name(self) -> pulumi.Output[_builtins.str]:
|
|
2163
2164
|
"""
|
|
2164
2165
|
The name of the index to create.
|
|
2165
2166
|
"""
|
|
2166
2167
|
return pulumi.get(self, "name")
|
|
2167
2168
|
|
|
2168
|
-
@property
|
|
2169
|
+
@_builtins.property
|
|
2169
2170
|
@pulumi.getter(name="partialServiceMetaPeriod")
|
|
2170
|
-
def partial_service_meta_period(self) -> pulumi.Output[int]:
|
|
2171
|
+
def partial_service_meta_period(self) -> pulumi.Output[_builtins.int]:
|
|
2171
2172
|
"""
|
|
2172
2173
|
Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
2173
2174
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
@@ -2176,9 +2177,9 @@ class Indexes(pulumi.CustomResource):
|
|
|
2176
2177
|
"""
|
|
2177
2178
|
return pulumi.get(self, "partial_service_meta_period")
|
|
2178
2179
|
|
|
2179
|
-
@property
|
|
2180
|
+
@_builtins.property
|
|
2180
2181
|
@pulumi.getter(name="processTrackerServiceInterval")
|
|
2181
|
-
def process_tracker_service_interval(self) -> pulumi.Output[int]:
|
|
2182
|
+
def process_tracker_service_interval(self) -> pulumi.Output[_builtins.int]:
|
|
2182
2183
|
"""
|
|
2183
2184
|
Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
2184
2185
|
If set to 0, the indexer checks child process status every second.
|
|
@@ -2186,34 +2187,34 @@ class Indexes(pulumi.CustomResource):
|
|
|
2186
2187
|
"""
|
|
2187
2188
|
return pulumi.get(self, "process_tracker_service_interval")
|
|
2188
2189
|
|
|
2189
|
-
@property
|
|
2190
|
+
@_builtins.property
|
|
2190
2191
|
@pulumi.getter(name="quarantineFutureSecs")
|
|
2191
|
-
def quarantine_future_secs(self) -> pulumi.Output[int]:
|
|
2192
|
+
def quarantine_future_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2192
2193
|
"""
|
|
2193
2194
|
Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
2194
2195
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
2195
2196
|
"""
|
|
2196
2197
|
return pulumi.get(self, "quarantine_future_secs")
|
|
2197
2198
|
|
|
2198
|
-
@property
|
|
2199
|
+
@_builtins.property
|
|
2199
2200
|
@pulumi.getter(name="quarantinePastSecs")
|
|
2200
|
-
def quarantine_past_secs(self) -> pulumi.Output[int]:
|
|
2201
|
+
def quarantine_past_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2201
2202
|
"""
|
|
2202
2203
|
Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
2203
2204
|
"""
|
|
2204
2205
|
return pulumi.get(self, "quarantine_past_secs")
|
|
2205
2206
|
|
|
2206
|
-
@property
|
|
2207
|
+
@_builtins.property
|
|
2207
2208
|
@pulumi.getter(name="rawChunkSizeBytes")
|
|
2208
|
-
def raw_chunk_size_bytes(self) -> pulumi.Output[int]:
|
|
2209
|
+
def raw_chunk_size_bytes(self) -> pulumi.Output[_builtins.int]:
|
|
2209
2210
|
"""
|
|
2210
2211
|
Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
2211
2212
|
"""
|
|
2212
2213
|
return pulumi.get(self, "raw_chunk_size_bytes")
|
|
2213
2214
|
|
|
2214
|
-
@property
|
|
2215
|
+
@_builtins.property
|
|
2215
2216
|
@pulumi.getter(name="repFactor")
|
|
2216
|
-
def rep_factor(self) -> pulumi.Output[str]:
|
|
2217
|
+
def rep_factor(self) -> pulumi.Output[_builtins.str]:
|
|
2217
2218
|
"""
|
|
2218
2219
|
Index replication control. This parameter applies to only clustering slaves.
|
|
2219
2220
|
auto = Use the master index replication configuration value.
|
|
@@ -2221,34 +2222,34 @@ class Indexes(pulumi.CustomResource):
|
|
|
2221
2222
|
"""
|
|
2222
2223
|
return pulumi.get(self, "rep_factor")
|
|
2223
2224
|
|
|
2224
|
-
@property
|
|
2225
|
+
@_builtins.property
|
|
2225
2226
|
@pulumi.getter(name="rotatePeriodInSecs")
|
|
2226
|
-
def rotate_period_in_secs(self) -> pulumi.Output[int]:
|
|
2227
|
+
def rotate_period_in_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2227
2228
|
"""
|
|
2228
2229
|
How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
2229
2230
|
"""
|
|
2230
2231
|
return pulumi.get(self, "rotate_period_in_secs")
|
|
2231
2232
|
|
|
2232
|
-
@property
|
|
2233
|
+
@_builtins.property
|
|
2233
2234
|
@pulumi.getter(name="serviceMetaPeriod")
|
|
2234
|
-
def service_meta_period(self) -> pulumi.Output[int]:
|
|
2235
|
+
def service_meta_period(self) -> pulumi.Output[_builtins.int]:
|
|
2235
2236
|
"""
|
|
2236
2237
|
Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
2237
2238
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
2238
2239
|
"""
|
|
2239
2240
|
return pulumi.get(self, "service_meta_period")
|
|
2240
2241
|
|
|
2241
|
-
@property
|
|
2242
|
+
@_builtins.property
|
|
2242
2243
|
@pulumi.getter(name="syncMeta")
|
|
2243
|
-
def sync_meta(self) -> pulumi.Output[bool]:
|
|
2244
|
+
def sync_meta(self) -> pulumi.Output[_builtins.bool]:
|
|
2244
2245
|
"""
|
|
2245
2246
|
When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
2246
2247
|
"""
|
|
2247
2248
|
return pulumi.get(self, "sync_meta")
|
|
2248
2249
|
|
|
2249
|
-
@property
|
|
2250
|
+
@_builtins.property
|
|
2250
2251
|
@pulumi.getter(name="thawedPath")
|
|
2251
|
-
def thawed_path(self) -> pulumi.Output[str]:
|
|
2252
|
+
def thawed_path(self) -> pulumi.Output[_builtins.str]:
|
|
2252
2253
|
"""
|
|
2253
2254
|
An absolute path that contains the thawed (resurrected) databases for the index.
|
|
2254
2255
|
Cannot be defined in terms of a volume definition.
|
|
@@ -2256,26 +2257,26 @@ class Indexes(pulumi.CustomResource):
|
|
|
2256
2257
|
"""
|
|
2257
2258
|
return pulumi.get(self, "thawed_path")
|
|
2258
2259
|
|
|
2259
|
-
@property
|
|
2260
|
+
@_builtins.property
|
|
2260
2261
|
@pulumi.getter(name="throttleCheckPeriod")
|
|
2261
|
-
def throttle_check_period(self) -> pulumi.Output[int]:
|
|
2262
|
+
def throttle_check_period(self) -> pulumi.Output[_builtins.int]:
|
|
2262
2263
|
"""
|
|
2263
2264
|
Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
2264
2265
|
"""
|
|
2265
2266
|
return pulumi.get(self, "throttle_check_period")
|
|
2266
2267
|
|
|
2267
|
-
@property
|
|
2268
|
+
@_builtins.property
|
|
2268
2269
|
@pulumi.getter(name="tstatsHomePath")
|
|
2269
|
-
def tstats_home_path(self) -> pulumi.Output[str]:
|
|
2270
|
+
def tstats_home_path(self) -> pulumi.Output[_builtins.str]:
|
|
2270
2271
|
"""
|
|
2271
2272
|
Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
2272
2273
|
If specified, it must be defined in terms of a volume definition.
|
|
2273
2274
|
"""
|
|
2274
2275
|
return pulumi.get(self, "tstats_home_path")
|
|
2275
2276
|
|
|
2276
|
-
@property
|
|
2277
|
+
@_builtins.property
|
|
2277
2278
|
@pulumi.getter(name="warmToColdScript")
|
|
2278
|
-
def warm_to_cold_script(self) -> pulumi.Output[str]:
|
|
2279
|
+
def warm_to_cold_script(self) -> pulumi.Output[_builtins.str]:
|
|
2279
2280
|
"""
|
|
2280
2281
|
Path to a script to run when moving data from warm to cold.
|
|
2281
2282
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|