pulumi-splunk 1.3.0a1743575469__py3-none-any.whl → 1.3.0a1744266748__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pulumi-splunk might be problematic. Click here for more details.
- pulumi_splunk/__init__.py +1 -0
- pulumi_splunk/_inputs.py +1065 -1064
- pulumi_splunk/admin_saml_groups.py +29 -28
- pulumi_splunk/apps_local.py +169 -168
- pulumi_splunk/authentication_users.py +127 -126
- pulumi_splunk/authorization_roles.py +183 -182
- pulumi_splunk/config/__init__.py +1 -0
- pulumi_splunk/config/__init__.pyi +1 -0
- pulumi_splunk/config/vars.py +1 -0
- pulumi_splunk/configs_conf.py +29 -28
- pulumi_splunk/data_ui_views.py +29 -28
- pulumi_splunk/generic_acl.py +15 -14
- pulumi_splunk/global_http_event_collector.py +99 -98
- pulumi_splunk/indexes.py +533 -532
- pulumi_splunk/inputs_http_event_collector.py +127 -126
- pulumi_splunk/inputs_monitor.py +211 -210
- pulumi_splunk/inputs_script.py +127 -126
- pulumi_splunk/inputs_tcp_cooked.py +71 -70
- pulumi_splunk/inputs_tcp_raw.py +141 -140
- pulumi_splunk/inputs_tcp_splunk_tcp_token.py +29 -28
- pulumi_splunk/inputs_tcp_ssl.py +71 -70
- pulumi_splunk/inputs_udp.py +155 -154
- pulumi_splunk/lookup_definition.py +29 -28
- pulumi_splunk/lookup_table_file.py +57 -56
- pulumi_splunk/outputs.py +647 -646
- pulumi_splunk/outputs_tcp_default.py +113 -112
- pulumi_splunk/outputs_tcp_group.py +141 -140
- pulumi_splunk/outputs_tcp_server.py +141 -140
- pulumi_splunk/outputs_tcp_syslog.py +99 -98
- pulumi_splunk/provider.py +47 -46
- pulumi_splunk/pulumi-plugin.json +1 -1
- pulumi_splunk/saved_searches.py +2304 -2303
- pulumi_splunk/sh_indexes_manager.py +57 -56
- {pulumi_splunk-1.3.0a1743575469.dist-info → pulumi_splunk-1.3.0a1744266748.dist-info}/METADATA +1 -1
- pulumi_splunk-1.3.0a1744266748.dist-info/RECORD +39 -0
- pulumi_splunk-1.3.0a1743575469.dist-info/RECORD +0 -39
- {pulumi_splunk-1.3.0a1743575469.dist-info → pulumi_splunk-1.3.0a1744266748.dist-info}/WHEEL +0 -0
- {pulumi_splunk-1.3.0a1743575469.dist-info → pulumi_splunk-1.3.0a1744266748.dist-info}/top_level.txt +0 -0
pulumi_splunk/indexes.py
CHANGED
|
@@ -2,6 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
+
import builtins
|
|
5
6
|
import copy
|
|
6
7
|
import warnings
|
|
7
8
|
import sys
|
|
@@ -22,57 +23,57 @@ __all__ = ['IndexesArgs', 'Indexes']
|
|
|
22
23
|
class IndexesArgs:
|
|
23
24
|
def __init__(__self__, *,
|
|
24
25
|
acl: Optional[pulumi.Input['IndexesAclArgs']] = None,
|
|
25
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
26
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
27
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
28
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
29
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
30
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
31
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
32
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
33
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
34
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
35
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
36
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
37
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
38
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
39
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
40
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
41
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
42
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
43
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
44
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
45
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
46
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
47
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
48
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
49
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
50
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
51
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
52
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
53
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
54
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
55
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
56
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
57
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
58
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
59
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
60
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
61
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
62
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None):
|
|
26
|
+
block_sign_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
27
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[builtins.str]] = None,
|
|
28
|
+
cold_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
29
|
+
cold_to_frozen_dir: Optional[pulumi.Input[builtins.str]] = None,
|
|
30
|
+
cold_to_frozen_script: Optional[pulumi.Input[builtins.str]] = None,
|
|
31
|
+
compress_rawdata: Optional[pulumi.Input[builtins.bool]] = None,
|
|
32
|
+
datatype: Optional[pulumi.Input[builtins.str]] = None,
|
|
33
|
+
enable_online_bucket_repair: Optional[pulumi.Input[builtins.bool]] = None,
|
|
34
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
35
|
+
home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
36
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[builtins.str]] = None,
|
|
37
|
+
max_concurrent_optimizes: Optional[pulumi.Input[builtins.int]] = None,
|
|
38
|
+
max_data_size: Optional[pulumi.Input[builtins.str]] = None,
|
|
39
|
+
max_hot_buckets: Optional[pulumi.Input[builtins.int]] = None,
|
|
40
|
+
max_hot_idle_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
41
|
+
max_hot_span_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
42
|
+
max_mem_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
43
|
+
max_meta_entries: Optional[pulumi.Input[builtins.int]] = None,
|
|
44
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
45
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
46
|
+
max_total_data_size_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
47
|
+
max_warm_db_count: Optional[pulumi.Input[builtins.int]] = None,
|
|
48
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[builtins.str]] = None,
|
|
49
|
+
min_stream_group_queue_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
50
|
+
name: Optional[pulumi.Input[builtins.str]] = None,
|
|
51
|
+
partial_service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
52
|
+
process_tracker_service_interval: Optional[pulumi.Input[builtins.int]] = None,
|
|
53
|
+
quarantine_future_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
54
|
+
quarantine_past_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
55
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[builtins.int]] = None,
|
|
56
|
+
rep_factor: Optional[pulumi.Input[builtins.str]] = None,
|
|
57
|
+
rotate_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
58
|
+
service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
59
|
+
sync_meta: Optional[pulumi.Input[builtins.bool]] = None,
|
|
60
|
+
thawed_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
61
|
+
throttle_check_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
62
|
+
tstats_home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
63
|
+
warm_to_cold_script: Optional[pulumi.Input[builtins.str]] = None):
|
|
63
64
|
"""
|
|
64
65
|
The set of arguments for constructing a Indexes resource.
|
|
65
66
|
:param pulumi.Input['IndexesAclArgs'] acl: The app/user context that is the namespace for the resource
|
|
66
|
-
:param pulumi.Input[int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
67
|
-
:param pulumi.Input[str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
67
|
+
:param pulumi.Input[builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
68
|
+
:param pulumi.Input[builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
68
69
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
69
70
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
70
71
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
71
72
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
72
73
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
73
74
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
74
|
-
:param pulumi.Input[str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
75
|
-
:param pulumi.Input[str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
75
|
+
:param pulumi.Input[builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
76
|
+
:param pulumi.Input[builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
76
77
|
<br>
|
|
77
78
|
Bucket freezing policy is as follows:<br>
|
|
78
79
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -80,70 +81,70 @@ class IndexesArgs:
|
|
|
80
81
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
81
82
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
82
83
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
83
|
-
:param pulumi.Input[str] cold_to_frozen_script: Path to the archiving script.
|
|
84
|
+
:param pulumi.Input[builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
84
85
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
85
86
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
86
87
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
87
|
-
:param pulumi.Input[bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
88
|
-
:param pulumi.Input[str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
89
|
-
:param pulumi.Input[bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
88
|
+
:param pulumi.Input[builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
89
|
+
:param pulumi.Input[builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
90
|
+
:param pulumi.Input[builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
90
91
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
91
|
-
:param pulumi.Input[int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
92
|
+
:param pulumi.Input[builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
92
93
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
93
|
-
:param pulumi.Input[str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
94
|
+
:param pulumi.Input[builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
94
95
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
95
96
|
<br>Caution: The path must be readable and writable.
|
|
96
|
-
:param pulumi.Input[str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
97
|
+
:param pulumi.Input[builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
97
98
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
98
|
-
:param pulumi.Input[int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
99
|
+
:param pulumi.Input[builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
99
100
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
100
|
-
:param pulumi.Input[str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
101
|
+
:param pulumi.Input[builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
101
102
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
102
|
-
:param pulumi.Input[int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
103
|
+
:param pulumi.Input[builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
103
104
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
104
|
-
:param pulumi.Input[int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
105
|
-
:param pulumi.Input[int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
106
|
-
:param pulumi.Input[int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
107
|
-
:param pulumi.Input[int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
108
|
-
:param pulumi.Input[int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
105
|
+
:param pulumi.Input[builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
106
|
+
:param pulumi.Input[builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
107
|
+
:param pulumi.Input[builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
108
|
+
:param pulumi.Input[builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
109
|
+
:param pulumi.Input[builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
109
110
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
110
111
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
111
|
-
:param pulumi.Input[int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
112
|
+
:param pulumi.Input[builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
112
113
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
113
114
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
114
|
-
:param pulumi.Input[int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
115
|
-
:param pulumi.Input[int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
116
|
-
:param pulumi.Input[str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
115
|
+
:param pulumi.Input[builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
116
|
+
:param pulumi.Input[builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
117
|
+
:param pulumi.Input[builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
117
118
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
118
119
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
119
120
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
120
|
-
:param pulumi.Input[int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
121
|
-
:param pulumi.Input[str] name: The name of the index to create.
|
|
122
|
-
:param pulumi.Input[int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
121
|
+
:param pulumi.Input[builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
122
|
+
:param pulumi.Input[builtins.str] name: The name of the index to create.
|
|
123
|
+
:param pulumi.Input[builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
123
124
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
124
125
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
125
126
|
By default it is turned off (zero).
|
|
126
|
-
:param pulumi.Input[int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
127
|
+
:param pulumi.Input[builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
127
128
|
If set to 0, the indexer checks child process status every second.
|
|
128
129
|
Highest legal value is 4294967295.
|
|
129
|
-
:param pulumi.Input[int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
130
|
+
:param pulumi.Input[builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
130
131
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
131
|
-
:param pulumi.Input[int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
132
|
-
:param pulumi.Input[int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
133
|
-
:param pulumi.Input[str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
132
|
+
:param pulumi.Input[builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
133
|
+
:param pulumi.Input[builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
134
|
+
:param pulumi.Input[builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
134
135
|
auto = Use the master index replication configuration value.
|
|
135
136
|
0 = Turn off replication for this index.
|
|
136
|
-
:param pulumi.Input[int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
137
|
-
:param pulumi.Input[int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
137
|
+
:param pulumi.Input[builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
138
|
+
:param pulumi.Input[builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
138
139
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
139
|
-
:param pulumi.Input[bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
140
|
-
:param pulumi.Input[str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
140
|
+
:param pulumi.Input[builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
141
|
+
:param pulumi.Input[builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
141
142
|
Cannot be defined in terms of a volume definition.
|
|
142
143
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
143
|
-
:param pulumi.Input[int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
144
|
-
:param pulumi.Input[str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
144
|
+
:param pulumi.Input[builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
145
|
+
:param pulumi.Input[builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
145
146
|
If specified, it must be defined in terms of a volume definition.
|
|
146
|
-
:param pulumi.Input[str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
147
|
+
:param pulumi.Input[builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
147
148
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
148
149
|
"""
|
|
149
150
|
if acl is not None:
|
|
@@ -239,19 +240,19 @@ class IndexesArgs:
|
|
|
239
240
|
|
|
240
241
|
@property
|
|
241
242
|
@pulumi.getter(name="blockSignSize")
|
|
242
|
-
def block_sign_size(self) -> Optional[pulumi.Input[int]]:
|
|
243
|
+
def block_sign_size(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
243
244
|
"""
|
|
244
245
|
Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
245
246
|
"""
|
|
246
247
|
return pulumi.get(self, "block_sign_size")
|
|
247
248
|
|
|
248
249
|
@block_sign_size.setter
|
|
249
|
-
def block_sign_size(self, value: Optional[pulumi.Input[int]]):
|
|
250
|
+
def block_sign_size(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
250
251
|
pulumi.set(self, "block_sign_size", value)
|
|
251
252
|
|
|
252
253
|
@property
|
|
253
254
|
@pulumi.getter(name="bucketRebuildMemoryHint")
|
|
254
|
-
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[str]]:
|
|
255
|
+
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
255
256
|
"""
|
|
256
257
|
Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
257
258
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
@@ -264,24 +265,24 @@ class IndexesArgs:
|
|
|
264
265
|
return pulumi.get(self, "bucket_rebuild_memory_hint")
|
|
265
266
|
|
|
266
267
|
@bucket_rebuild_memory_hint.setter
|
|
267
|
-
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[str]]):
|
|
268
|
+
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
268
269
|
pulumi.set(self, "bucket_rebuild_memory_hint", value)
|
|
269
270
|
|
|
270
271
|
@property
|
|
271
272
|
@pulumi.getter(name="coldPath")
|
|
272
|
-
def cold_path(self) -> Optional[pulumi.Input[str]]:
|
|
273
|
+
def cold_path(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
273
274
|
"""
|
|
274
275
|
An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
275
276
|
"""
|
|
276
277
|
return pulumi.get(self, "cold_path")
|
|
277
278
|
|
|
278
279
|
@cold_path.setter
|
|
279
|
-
def cold_path(self, value: Optional[pulumi.Input[str]]):
|
|
280
|
+
def cold_path(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
280
281
|
pulumi.set(self, "cold_path", value)
|
|
281
282
|
|
|
282
283
|
@property
|
|
283
284
|
@pulumi.getter(name="coldToFrozenDir")
|
|
284
|
-
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[str]]:
|
|
285
|
+
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
285
286
|
"""
|
|
286
287
|
Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
287
288
|
<br>
|
|
@@ -295,12 +296,12 @@ class IndexesArgs:
|
|
|
295
296
|
return pulumi.get(self, "cold_to_frozen_dir")
|
|
296
297
|
|
|
297
298
|
@cold_to_frozen_dir.setter
|
|
298
|
-
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[str]]):
|
|
299
|
+
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
299
300
|
pulumi.set(self, "cold_to_frozen_dir", value)
|
|
300
301
|
|
|
301
302
|
@property
|
|
302
303
|
@pulumi.getter(name="coldToFrozenScript")
|
|
303
|
-
def cold_to_frozen_script(self) -> Optional[pulumi.Input[str]]:
|
|
304
|
+
def cold_to_frozen_script(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
304
305
|
"""
|
|
305
306
|
Path to the archiving script.
|
|
306
307
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
@@ -310,36 +311,36 @@ class IndexesArgs:
|
|
|
310
311
|
return pulumi.get(self, "cold_to_frozen_script")
|
|
311
312
|
|
|
312
313
|
@cold_to_frozen_script.setter
|
|
313
|
-
def cold_to_frozen_script(self, value: Optional[pulumi.Input[str]]):
|
|
314
|
+
def cold_to_frozen_script(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
314
315
|
pulumi.set(self, "cold_to_frozen_script", value)
|
|
315
316
|
|
|
316
317
|
@property
|
|
317
318
|
@pulumi.getter(name="compressRawdata")
|
|
318
|
-
def compress_rawdata(self) -> Optional[pulumi.Input[bool]]:
|
|
319
|
+
def compress_rawdata(self) -> Optional[pulumi.Input[builtins.bool]]:
|
|
319
320
|
"""
|
|
320
321
|
This parameter is ignored. The splunkd process always compresses raw data.
|
|
321
322
|
"""
|
|
322
323
|
return pulumi.get(self, "compress_rawdata")
|
|
323
324
|
|
|
324
325
|
@compress_rawdata.setter
|
|
325
|
-
def compress_rawdata(self, value: Optional[pulumi.Input[bool]]):
|
|
326
|
+
def compress_rawdata(self, value: Optional[pulumi.Input[builtins.bool]]):
|
|
326
327
|
pulumi.set(self, "compress_rawdata", value)
|
|
327
328
|
|
|
328
329
|
@property
|
|
329
330
|
@pulumi.getter
|
|
330
|
-
def datatype(self) -> Optional[pulumi.Input[str]]:
|
|
331
|
+
def datatype(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
331
332
|
"""
|
|
332
333
|
Valid values: (event | metric). Specifies the type of index.
|
|
333
334
|
"""
|
|
334
335
|
return pulumi.get(self, "datatype")
|
|
335
336
|
|
|
336
337
|
@datatype.setter
|
|
337
|
-
def datatype(self, value: Optional[pulumi.Input[str]]):
|
|
338
|
+
def datatype(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
338
339
|
pulumi.set(self, "datatype", value)
|
|
339
340
|
|
|
340
341
|
@property
|
|
341
342
|
@pulumi.getter(name="enableOnlineBucketRepair")
|
|
342
|
-
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[bool]]:
|
|
343
|
+
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[builtins.bool]]:
|
|
343
344
|
"""
|
|
344
345
|
Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
345
346
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
@@ -347,12 +348,12 @@ class IndexesArgs:
|
|
|
347
348
|
return pulumi.get(self, "enable_online_bucket_repair")
|
|
348
349
|
|
|
349
350
|
@enable_online_bucket_repair.setter
|
|
350
|
-
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[bool]]):
|
|
351
|
+
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[builtins.bool]]):
|
|
351
352
|
pulumi.set(self, "enable_online_bucket_repair", value)
|
|
352
353
|
|
|
353
354
|
@property
|
|
354
355
|
@pulumi.getter(name="frozenTimePeriodInSecs")
|
|
355
|
-
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[int]]:
|
|
356
|
+
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
356
357
|
"""
|
|
357
358
|
Number of seconds after which indexed data rolls to frozen.
|
|
358
359
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
@@ -360,12 +361,12 @@ class IndexesArgs:
|
|
|
360
361
|
return pulumi.get(self, "frozen_time_period_in_secs")
|
|
361
362
|
|
|
362
363
|
@frozen_time_period_in_secs.setter
|
|
363
|
-
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[int]]):
|
|
364
|
+
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
364
365
|
pulumi.set(self, "frozen_time_period_in_secs", value)
|
|
365
366
|
|
|
366
367
|
@property
|
|
367
368
|
@pulumi.getter(name="homePath")
|
|
368
|
-
def home_path(self) -> Optional[pulumi.Input[str]]:
|
|
369
|
+
def home_path(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
369
370
|
"""
|
|
370
371
|
An absolute path that contains the hot and warm buckets for the index.
|
|
371
372
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
@@ -374,12 +375,12 @@ class IndexesArgs:
|
|
|
374
375
|
return pulumi.get(self, "home_path")
|
|
375
376
|
|
|
376
377
|
@home_path.setter
|
|
377
|
-
def home_path(self, value: Optional[pulumi.Input[str]]):
|
|
378
|
+
def home_path(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
378
379
|
pulumi.set(self, "home_path", value)
|
|
379
380
|
|
|
380
381
|
@property
|
|
381
382
|
@pulumi.getter(name="maxBloomBackfillBucketAge")
|
|
382
|
-
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[str]]:
|
|
383
|
+
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
383
384
|
"""
|
|
384
385
|
Valid values are: Integer[m|s|h|d].
|
|
385
386
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
@@ -387,12 +388,12 @@ class IndexesArgs:
|
|
|
387
388
|
return pulumi.get(self, "max_bloom_backfill_bucket_age")
|
|
388
389
|
|
|
389
390
|
@max_bloom_backfill_bucket_age.setter
|
|
390
|
-
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[str]]):
|
|
391
|
+
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
391
392
|
pulumi.set(self, "max_bloom_backfill_bucket_age", value)
|
|
392
393
|
|
|
393
394
|
@property
|
|
394
395
|
@pulumi.getter(name="maxConcurrentOptimizes")
|
|
395
|
-
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[int]]:
|
|
396
|
+
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
396
397
|
"""
|
|
397
398
|
The number of concurrent optimize processes that can run against a hot bucket.
|
|
398
399
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
@@ -400,12 +401,12 @@ class IndexesArgs:
|
|
|
400
401
|
return pulumi.get(self, "max_concurrent_optimizes")
|
|
401
402
|
|
|
402
403
|
@max_concurrent_optimizes.setter
|
|
403
|
-
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[int]]):
|
|
404
|
+
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
404
405
|
pulumi.set(self, "max_concurrent_optimizes", value)
|
|
405
406
|
|
|
406
407
|
@property
|
|
407
408
|
@pulumi.getter(name="maxDataSize")
|
|
408
|
-
def max_data_size(self) -> Optional[pulumi.Input[str]]:
|
|
409
|
+
def max_data_size(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
409
410
|
"""
|
|
410
411
|
The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
411
412
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
@@ -413,12 +414,12 @@ class IndexesArgs:
|
|
|
413
414
|
return pulumi.get(self, "max_data_size")
|
|
414
415
|
|
|
415
416
|
@max_data_size.setter
|
|
416
|
-
def max_data_size(self, value: Optional[pulumi.Input[str]]):
|
|
417
|
+
def max_data_size(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
417
418
|
pulumi.set(self, "max_data_size", value)
|
|
418
419
|
|
|
419
420
|
@property
|
|
420
421
|
@pulumi.getter(name="maxHotBuckets")
|
|
421
|
-
def max_hot_buckets(self) -> Optional[pulumi.Input[int]]:
|
|
422
|
+
def max_hot_buckets(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
422
423
|
"""
|
|
423
424
|
Maximum hot buckets that can exist per index. Defaults to 3.
|
|
424
425
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
@@ -426,60 +427,60 @@ class IndexesArgs:
|
|
|
426
427
|
return pulumi.get(self, "max_hot_buckets")
|
|
427
428
|
|
|
428
429
|
@max_hot_buckets.setter
|
|
429
|
-
def max_hot_buckets(self, value: Optional[pulumi.Input[int]]):
|
|
430
|
+
def max_hot_buckets(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
430
431
|
pulumi.set(self, "max_hot_buckets", value)
|
|
431
432
|
|
|
432
433
|
@property
|
|
433
434
|
@pulumi.getter(name="maxHotIdleSecs")
|
|
434
|
-
def max_hot_idle_secs(self) -> Optional[pulumi.Input[int]]:
|
|
435
|
+
def max_hot_idle_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
435
436
|
"""
|
|
436
437
|
Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
437
438
|
"""
|
|
438
439
|
return pulumi.get(self, "max_hot_idle_secs")
|
|
439
440
|
|
|
440
441
|
@max_hot_idle_secs.setter
|
|
441
|
-
def max_hot_idle_secs(self, value: Optional[pulumi.Input[int]]):
|
|
442
|
+
def max_hot_idle_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
442
443
|
pulumi.set(self, "max_hot_idle_secs", value)
|
|
443
444
|
|
|
444
445
|
@property
|
|
445
446
|
@pulumi.getter(name="maxHotSpanSecs")
|
|
446
|
-
def max_hot_span_secs(self) -> Optional[pulumi.Input[int]]:
|
|
447
|
+
def max_hot_span_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
447
448
|
"""
|
|
448
449
|
Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
449
450
|
"""
|
|
450
451
|
return pulumi.get(self, "max_hot_span_secs")
|
|
451
452
|
|
|
452
453
|
@max_hot_span_secs.setter
|
|
453
|
-
def max_hot_span_secs(self, value: Optional[pulumi.Input[int]]):
|
|
454
|
+
def max_hot_span_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
454
455
|
pulumi.set(self, "max_hot_span_secs", value)
|
|
455
456
|
|
|
456
457
|
@property
|
|
457
458
|
@pulumi.getter(name="maxMemMb")
|
|
458
|
-
def max_mem_mb(self) -> Optional[pulumi.Input[int]]:
|
|
459
|
+
def max_mem_mb(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
459
460
|
"""
|
|
460
461
|
The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
461
462
|
"""
|
|
462
463
|
return pulumi.get(self, "max_mem_mb")
|
|
463
464
|
|
|
464
465
|
@max_mem_mb.setter
|
|
465
|
-
def max_mem_mb(self, value: Optional[pulumi.Input[int]]):
|
|
466
|
+
def max_mem_mb(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
466
467
|
pulumi.set(self, "max_mem_mb", value)
|
|
467
468
|
|
|
468
469
|
@property
|
|
469
470
|
@pulumi.getter(name="maxMetaEntries")
|
|
470
|
-
def max_meta_entries(self) -> Optional[pulumi.Input[int]]:
|
|
471
|
+
def max_meta_entries(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
471
472
|
"""
|
|
472
473
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
473
474
|
"""
|
|
474
475
|
return pulumi.get(self, "max_meta_entries")
|
|
475
476
|
|
|
476
477
|
@max_meta_entries.setter
|
|
477
|
-
def max_meta_entries(self, value: Optional[pulumi.Input[int]]):
|
|
478
|
+
def max_meta_entries(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
478
479
|
pulumi.set(self, "max_meta_entries", value)
|
|
479
480
|
|
|
480
481
|
@property
|
|
481
482
|
@pulumi.getter(name="maxTimeUnreplicatedNoAcks")
|
|
482
|
-
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[int]]:
|
|
483
|
+
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
483
484
|
"""
|
|
484
485
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
485
486
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
@@ -488,12 +489,12 @@ class IndexesArgs:
|
|
|
488
489
|
return pulumi.get(self, "max_time_unreplicated_no_acks")
|
|
489
490
|
|
|
490
491
|
@max_time_unreplicated_no_acks.setter
|
|
491
|
-
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[int]]):
|
|
492
|
+
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
492
493
|
pulumi.set(self, "max_time_unreplicated_no_acks", value)
|
|
493
494
|
|
|
494
495
|
@property
|
|
495
496
|
@pulumi.getter(name="maxTimeUnreplicatedWithAcks")
|
|
496
|
-
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[int]]:
|
|
497
|
+
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
497
498
|
"""
|
|
498
499
|
Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
499
500
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
@@ -502,36 +503,36 @@ class IndexesArgs:
|
|
|
502
503
|
return pulumi.get(self, "max_time_unreplicated_with_acks")
|
|
503
504
|
|
|
504
505
|
@max_time_unreplicated_with_acks.setter
|
|
505
|
-
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[int]]):
|
|
506
|
+
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
506
507
|
pulumi.set(self, "max_time_unreplicated_with_acks", value)
|
|
507
508
|
|
|
508
509
|
@property
|
|
509
510
|
@pulumi.getter(name="maxTotalDataSizeMb")
|
|
510
|
-
def max_total_data_size_mb(self) -> Optional[pulumi.Input[int]]:
|
|
511
|
+
def max_total_data_size_mb(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
511
512
|
"""
|
|
512
513
|
The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
513
514
|
"""
|
|
514
515
|
return pulumi.get(self, "max_total_data_size_mb")
|
|
515
516
|
|
|
516
517
|
@max_total_data_size_mb.setter
|
|
517
|
-
def max_total_data_size_mb(self, value: Optional[pulumi.Input[int]]):
|
|
518
|
+
def max_total_data_size_mb(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
518
519
|
pulumi.set(self, "max_total_data_size_mb", value)
|
|
519
520
|
|
|
520
521
|
@property
|
|
521
522
|
@pulumi.getter(name="maxWarmDbCount")
|
|
522
|
-
def max_warm_db_count(self) -> Optional[pulumi.Input[int]]:
|
|
523
|
+
def max_warm_db_count(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
523
524
|
"""
|
|
524
525
|
The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
525
526
|
"""
|
|
526
527
|
return pulumi.get(self, "max_warm_db_count")
|
|
527
528
|
|
|
528
529
|
@max_warm_db_count.setter
|
|
529
|
-
def max_warm_db_count(self, value: Optional[pulumi.Input[int]]):
|
|
530
|
+
def max_warm_db_count(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
530
531
|
pulumi.set(self, "max_warm_db_count", value)
|
|
531
532
|
|
|
532
533
|
@property
|
|
533
534
|
@pulumi.getter(name="minRawFileSyncSecs")
|
|
534
|
-
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[str]]:
|
|
535
|
+
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
535
536
|
"""
|
|
536
537
|
Specify an integer (or "disable") for this parameter.
|
|
537
538
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
@@ -541,36 +542,36 @@ class IndexesArgs:
|
|
|
541
542
|
return pulumi.get(self, "min_raw_file_sync_secs")
|
|
542
543
|
|
|
543
544
|
@min_raw_file_sync_secs.setter
|
|
544
|
-
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[str]]):
|
|
545
|
+
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
545
546
|
pulumi.set(self, "min_raw_file_sync_secs", value)
|
|
546
547
|
|
|
547
548
|
@property
|
|
548
549
|
@pulumi.getter(name="minStreamGroupQueueSize")
|
|
549
|
-
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[int]]:
|
|
550
|
+
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
550
551
|
"""
|
|
551
552
|
Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
552
553
|
"""
|
|
553
554
|
return pulumi.get(self, "min_stream_group_queue_size")
|
|
554
555
|
|
|
555
556
|
@min_stream_group_queue_size.setter
|
|
556
|
-
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[int]]):
|
|
557
|
+
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
557
558
|
pulumi.set(self, "min_stream_group_queue_size", value)
|
|
558
559
|
|
|
559
560
|
@property
|
|
560
561
|
@pulumi.getter
|
|
561
|
-
def name(self) -> Optional[pulumi.Input[str]]:
|
|
562
|
+
def name(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
562
563
|
"""
|
|
563
564
|
The name of the index to create.
|
|
564
565
|
"""
|
|
565
566
|
return pulumi.get(self, "name")
|
|
566
567
|
|
|
567
568
|
@name.setter
|
|
568
|
-
def name(self, value: Optional[pulumi.Input[str]]):
|
|
569
|
+
def name(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
569
570
|
pulumi.set(self, "name", value)
|
|
570
571
|
|
|
571
572
|
@property
|
|
572
573
|
@pulumi.getter(name="partialServiceMetaPeriod")
|
|
573
|
-
def partial_service_meta_period(self) -> Optional[pulumi.Input[int]]:
|
|
574
|
+
def partial_service_meta_period(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
574
575
|
"""
|
|
575
576
|
Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
576
577
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
@@ -580,12 +581,12 @@ class IndexesArgs:
|
|
|
580
581
|
return pulumi.get(self, "partial_service_meta_period")
|
|
581
582
|
|
|
582
583
|
@partial_service_meta_period.setter
|
|
583
|
-
def partial_service_meta_period(self, value: Optional[pulumi.Input[int]]):
|
|
584
|
+
def partial_service_meta_period(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
584
585
|
pulumi.set(self, "partial_service_meta_period", value)
|
|
585
586
|
|
|
586
587
|
@property
|
|
587
588
|
@pulumi.getter(name="processTrackerServiceInterval")
|
|
588
|
-
def process_tracker_service_interval(self) -> Optional[pulumi.Input[int]]:
|
|
589
|
+
def process_tracker_service_interval(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
589
590
|
"""
|
|
590
591
|
Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
591
592
|
If set to 0, the indexer checks child process status every second.
|
|
@@ -594,12 +595,12 @@ class IndexesArgs:
|
|
|
594
595
|
return pulumi.get(self, "process_tracker_service_interval")
|
|
595
596
|
|
|
596
597
|
@process_tracker_service_interval.setter
|
|
597
|
-
def process_tracker_service_interval(self, value: Optional[pulumi.Input[int]]):
|
|
598
|
+
def process_tracker_service_interval(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
598
599
|
pulumi.set(self, "process_tracker_service_interval", value)
|
|
599
600
|
|
|
600
601
|
@property
|
|
601
602
|
@pulumi.getter(name="quarantineFutureSecs")
|
|
602
|
-
def quarantine_future_secs(self) -> Optional[pulumi.Input[int]]:
|
|
603
|
+
def quarantine_future_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
603
604
|
"""
|
|
604
605
|
Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
605
606
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
@@ -607,36 +608,36 @@ class IndexesArgs:
|
|
|
607
608
|
return pulumi.get(self, "quarantine_future_secs")
|
|
608
609
|
|
|
609
610
|
@quarantine_future_secs.setter
|
|
610
|
-
def quarantine_future_secs(self, value: Optional[pulumi.Input[int]]):
|
|
611
|
+
def quarantine_future_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
611
612
|
pulumi.set(self, "quarantine_future_secs", value)
|
|
612
613
|
|
|
613
614
|
@property
|
|
614
615
|
@pulumi.getter(name="quarantinePastSecs")
|
|
615
|
-
def quarantine_past_secs(self) -> Optional[pulumi.Input[int]]:
|
|
616
|
+
def quarantine_past_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
616
617
|
"""
|
|
617
618
|
Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
618
619
|
"""
|
|
619
620
|
return pulumi.get(self, "quarantine_past_secs")
|
|
620
621
|
|
|
621
622
|
@quarantine_past_secs.setter
|
|
622
|
-
def quarantine_past_secs(self, value: Optional[pulumi.Input[int]]):
|
|
623
|
+
def quarantine_past_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
623
624
|
pulumi.set(self, "quarantine_past_secs", value)
|
|
624
625
|
|
|
625
626
|
@property
|
|
626
627
|
@pulumi.getter(name="rawChunkSizeBytes")
|
|
627
|
-
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[int]]:
|
|
628
|
+
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
628
629
|
"""
|
|
629
630
|
Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
630
631
|
"""
|
|
631
632
|
return pulumi.get(self, "raw_chunk_size_bytes")
|
|
632
633
|
|
|
633
634
|
@raw_chunk_size_bytes.setter
|
|
634
|
-
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[int]]):
|
|
635
|
+
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
635
636
|
pulumi.set(self, "raw_chunk_size_bytes", value)
|
|
636
637
|
|
|
637
638
|
@property
|
|
638
639
|
@pulumi.getter(name="repFactor")
|
|
639
|
-
def rep_factor(self) -> Optional[pulumi.Input[str]]:
|
|
640
|
+
def rep_factor(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
640
641
|
"""
|
|
641
642
|
Index replication control. This parameter applies to only clustering slaves.
|
|
642
643
|
auto = Use the master index replication configuration value.
|
|
@@ -645,24 +646,24 @@ class IndexesArgs:
|
|
|
645
646
|
return pulumi.get(self, "rep_factor")
|
|
646
647
|
|
|
647
648
|
@rep_factor.setter
|
|
648
|
-
def rep_factor(self, value: Optional[pulumi.Input[str]]):
|
|
649
|
+
def rep_factor(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
649
650
|
pulumi.set(self, "rep_factor", value)
|
|
650
651
|
|
|
651
652
|
@property
|
|
652
653
|
@pulumi.getter(name="rotatePeriodInSecs")
|
|
653
|
-
def rotate_period_in_secs(self) -> Optional[pulumi.Input[int]]:
|
|
654
|
+
def rotate_period_in_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
654
655
|
"""
|
|
655
656
|
How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
656
657
|
"""
|
|
657
658
|
return pulumi.get(self, "rotate_period_in_secs")
|
|
658
659
|
|
|
659
660
|
@rotate_period_in_secs.setter
|
|
660
|
-
def rotate_period_in_secs(self, value: Optional[pulumi.Input[int]]):
|
|
661
|
+
def rotate_period_in_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
661
662
|
pulumi.set(self, "rotate_period_in_secs", value)
|
|
662
663
|
|
|
663
664
|
@property
|
|
664
665
|
@pulumi.getter(name="serviceMetaPeriod")
|
|
665
|
-
def service_meta_period(self) -> Optional[pulumi.Input[int]]:
|
|
666
|
+
def service_meta_period(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
666
667
|
"""
|
|
667
668
|
Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
668
669
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
@@ -670,24 +671,24 @@ class IndexesArgs:
|
|
|
670
671
|
return pulumi.get(self, "service_meta_period")
|
|
671
672
|
|
|
672
673
|
@service_meta_period.setter
|
|
673
|
-
def service_meta_period(self, value: Optional[pulumi.Input[int]]):
|
|
674
|
+
def service_meta_period(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
674
675
|
pulumi.set(self, "service_meta_period", value)
|
|
675
676
|
|
|
676
677
|
@property
|
|
677
678
|
@pulumi.getter(name="syncMeta")
|
|
678
|
-
def sync_meta(self) -> Optional[pulumi.Input[bool]]:
|
|
679
|
+
def sync_meta(self) -> Optional[pulumi.Input[builtins.bool]]:
|
|
679
680
|
"""
|
|
680
681
|
When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
681
682
|
"""
|
|
682
683
|
return pulumi.get(self, "sync_meta")
|
|
683
684
|
|
|
684
685
|
@sync_meta.setter
|
|
685
|
-
def sync_meta(self, value: Optional[pulumi.Input[bool]]):
|
|
686
|
+
def sync_meta(self, value: Optional[pulumi.Input[builtins.bool]]):
|
|
686
687
|
pulumi.set(self, "sync_meta", value)
|
|
687
688
|
|
|
688
689
|
@property
|
|
689
690
|
@pulumi.getter(name="thawedPath")
|
|
690
|
-
def thawed_path(self) -> Optional[pulumi.Input[str]]:
|
|
691
|
+
def thawed_path(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
691
692
|
"""
|
|
692
693
|
An absolute path that contains the thawed (resurrected) databases for the index.
|
|
693
694
|
Cannot be defined in terms of a volume definition.
|
|
@@ -696,24 +697,24 @@ class IndexesArgs:
|
|
|
696
697
|
return pulumi.get(self, "thawed_path")
|
|
697
698
|
|
|
698
699
|
@thawed_path.setter
|
|
699
|
-
def thawed_path(self, value: Optional[pulumi.Input[str]]):
|
|
700
|
+
def thawed_path(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
700
701
|
pulumi.set(self, "thawed_path", value)
|
|
701
702
|
|
|
702
703
|
@property
|
|
703
704
|
@pulumi.getter(name="throttleCheckPeriod")
|
|
704
|
-
def throttle_check_period(self) -> Optional[pulumi.Input[int]]:
|
|
705
|
+
def throttle_check_period(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
705
706
|
"""
|
|
706
707
|
Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
707
708
|
"""
|
|
708
709
|
return pulumi.get(self, "throttle_check_period")
|
|
709
710
|
|
|
710
711
|
@throttle_check_period.setter
|
|
711
|
-
def throttle_check_period(self, value: Optional[pulumi.Input[int]]):
|
|
712
|
+
def throttle_check_period(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
712
713
|
pulumi.set(self, "throttle_check_period", value)
|
|
713
714
|
|
|
714
715
|
@property
|
|
715
716
|
@pulumi.getter(name="tstatsHomePath")
|
|
716
|
-
def tstats_home_path(self) -> Optional[pulumi.Input[str]]:
|
|
717
|
+
def tstats_home_path(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
717
718
|
"""
|
|
718
719
|
Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
719
720
|
If specified, it must be defined in terms of a volume definition.
|
|
@@ -721,12 +722,12 @@ class IndexesArgs:
|
|
|
721
722
|
return pulumi.get(self, "tstats_home_path")
|
|
722
723
|
|
|
723
724
|
@tstats_home_path.setter
|
|
724
|
-
def tstats_home_path(self, value: Optional[pulumi.Input[str]]):
|
|
725
|
+
def tstats_home_path(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
725
726
|
pulumi.set(self, "tstats_home_path", value)
|
|
726
727
|
|
|
727
728
|
@property
|
|
728
729
|
@pulumi.getter(name="warmToColdScript")
|
|
729
|
-
def warm_to_cold_script(self) -> Optional[pulumi.Input[str]]:
|
|
730
|
+
def warm_to_cold_script(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
730
731
|
"""
|
|
731
732
|
Path to a script to run when moving data from warm to cold.
|
|
732
733
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
@@ -734,7 +735,7 @@ class IndexesArgs:
|
|
|
734
735
|
return pulumi.get(self, "warm_to_cold_script")
|
|
735
736
|
|
|
736
737
|
@warm_to_cold_script.setter
|
|
737
|
-
def warm_to_cold_script(self, value: Optional[pulumi.Input[str]]):
|
|
738
|
+
def warm_to_cold_script(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
738
739
|
pulumi.set(self, "warm_to_cold_script", value)
|
|
739
740
|
|
|
740
741
|
|
|
@@ -742,57 +743,57 @@ class IndexesArgs:
|
|
|
742
743
|
class _IndexesState:
|
|
743
744
|
def __init__(__self__, *,
|
|
744
745
|
acl: Optional[pulumi.Input['IndexesAclArgs']] = None,
|
|
745
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
746
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
747
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
748
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
749
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
750
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
751
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
752
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
753
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
754
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
755
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
756
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
757
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
758
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
759
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
760
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
761
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
762
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
763
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
764
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
765
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
766
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
767
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
768
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
769
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
770
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
771
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
772
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
773
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
774
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
775
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
776
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
777
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
778
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
779
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
780
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
781
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
782
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None):
|
|
746
|
+
block_sign_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
747
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[builtins.str]] = None,
|
|
748
|
+
cold_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
749
|
+
cold_to_frozen_dir: Optional[pulumi.Input[builtins.str]] = None,
|
|
750
|
+
cold_to_frozen_script: Optional[pulumi.Input[builtins.str]] = None,
|
|
751
|
+
compress_rawdata: Optional[pulumi.Input[builtins.bool]] = None,
|
|
752
|
+
datatype: Optional[pulumi.Input[builtins.str]] = None,
|
|
753
|
+
enable_online_bucket_repair: Optional[pulumi.Input[builtins.bool]] = None,
|
|
754
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
755
|
+
home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
756
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[builtins.str]] = None,
|
|
757
|
+
max_concurrent_optimizes: Optional[pulumi.Input[builtins.int]] = None,
|
|
758
|
+
max_data_size: Optional[pulumi.Input[builtins.str]] = None,
|
|
759
|
+
max_hot_buckets: Optional[pulumi.Input[builtins.int]] = None,
|
|
760
|
+
max_hot_idle_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
761
|
+
max_hot_span_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
762
|
+
max_mem_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
763
|
+
max_meta_entries: Optional[pulumi.Input[builtins.int]] = None,
|
|
764
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
765
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
766
|
+
max_total_data_size_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
767
|
+
max_warm_db_count: Optional[pulumi.Input[builtins.int]] = None,
|
|
768
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[builtins.str]] = None,
|
|
769
|
+
min_stream_group_queue_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
770
|
+
name: Optional[pulumi.Input[builtins.str]] = None,
|
|
771
|
+
partial_service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
772
|
+
process_tracker_service_interval: Optional[pulumi.Input[builtins.int]] = None,
|
|
773
|
+
quarantine_future_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
774
|
+
quarantine_past_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
775
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[builtins.int]] = None,
|
|
776
|
+
rep_factor: Optional[pulumi.Input[builtins.str]] = None,
|
|
777
|
+
rotate_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
778
|
+
service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
779
|
+
sync_meta: Optional[pulumi.Input[builtins.bool]] = None,
|
|
780
|
+
thawed_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
781
|
+
throttle_check_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
782
|
+
tstats_home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
783
|
+
warm_to_cold_script: Optional[pulumi.Input[builtins.str]] = None):
|
|
783
784
|
"""
|
|
784
785
|
Input properties used for looking up and filtering Indexes resources.
|
|
785
786
|
:param pulumi.Input['IndexesAclArgs'] acl: The app/user context that is the namespace for the resource
|
|
786
|
-
:param pulumi.Input[int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
787
|
-
:param pulumi.Input[str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
787
|
+
:param pulumi.Input[builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
788
|
+
:param pulumi.Input[builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
788
789
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
789
790
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
790
791
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
791
792
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
792
793
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
793
794
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
794
|
-
:param pulumi.Input[str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
795
|
-
:param pulumi.Input[str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
795
|
+
:param pulumi.Input[builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
796
|
+
:param pulumi.Input[builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
796
797
|
<br>
|
|
797
798
|
Bucket freezing policy is as follows:<br>
|
|
798
799
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -800,70 +801,70 @@ class _IndexesState:
|
|
|
800
801
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
801
802
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
802
803
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
803
|
-
:param pulumi.Input[str] cold_to_frozen_script: Path to the archiving script.
|
|
804
|
+
:param pulumi.Input[builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
804
805
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
805
806
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
806
807
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
807
|
-
:param pulumi.Input[bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
808
|
-
:param pulumi.Input[str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
809
|
-
:param pulumi.Input[bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
808
|
+
:param pulumi.Input[builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
809
|
+
:param pulumi.Input[builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
810
|
+
:param pulumi.Input[builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
810
811
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
811
|
-
:param pulumi.Input[int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
812
|
+
:param pulumi.Input[builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
812
813
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
813
|
-
:param pulumi.Input[str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
814
|
+
:param pulumi.Input[builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
814
815
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
815
816
|
<br>Caution: The path must be readable and writable.
|
|
816
|
-
:param pulumi.Input[str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
817
|
+
:param pulumi.Input[builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
817
818
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
818
|
-
:param pulumi.Input[int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
819
|
+
:param pulumi.Input[builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
819
820
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
820
|
-
:param pulumi.Input[str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
821
|
+
:param pulumi.Input[builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
821
822
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
822
|
-
:param pulumi.Input[int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
823
|
+
:param pulumi.Input[builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
823
824
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
824
|
-
:param pulumi.Input[int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
825
|
-
:param pulumi.Input[int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
826
|
-
:param pulumi.Input[int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
827
|
-
:param pulumi.Input[int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
828
|
-
:param pulumi.Input[int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
825
|
+
:param pulumi.Input[builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
826
|
+
:param pulumi.Input[builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
827
|
+
:param pulumi.Input[builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
828
|
+
:param pulumi.Input[builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
829
|
+
:param pulumi.Input[builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
829
830
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
830
831
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
831
|
-
:param pulumi.Input[int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
832
|
+
:param pulumi.Input[builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
832
833
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
833
834
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
834
|
-
:param pulumi.Input[int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
835
|
-
:param pulumi.Input[int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
836
|
-
:param pulumi.Input[str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
835
|
+
:param pulumi.Input[builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
836
|
+
:param pulumi.Input[builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
837
|
+
:param pulumi.Input[builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
837
838
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
838
839
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
839
840
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
840
|
-
:param pulumi.Input[int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
841
|
-
:param pulumi.Input[str] name: The name of the index to create.
|
|
842
|
-
:param pulumi.Input[int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
841
|
+
:param pulumi.Input[builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
842
|
+
:param pulumi.Input[builtins.str] name: The name of the index to create.
|
|
843
|
+
:param pulumi.Input[builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
843
844
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
844
845
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
845
846
|
By default it is turned off (zero).
|
|
846
|
-
:param pulumi.Input[int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
847
|
+
:param pulumi.Input[builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
847
848
|
If set to 0, the indexer checks child process status every second.
|
|
848
849
|
Highest legal value is 4294967295.
|
|
849
|
-
:param pulumi.Input[int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
850
|
+
:param pulumi.Input[builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
850
851
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
851
|
-
:param pulumi.Input[int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
852
|
-
:param pulumi.Input[int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
853
|
-
:param pulumi.Input[str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
852
|
+
:param pulumi.Input[builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
853
|
+
:param pulumi.Input[builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
854
|
+
:param pulumi.Input[builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
854
855
|
auto = Use the master index replication configuration value.
|
|
855
856
|
0 = Turn off replication for this index.
|
|
856
|
-
:param pulumi.Input[int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
857
|
-
:param pulumi.Input[int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
857
|
+
:param pulumi.Input[builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
858
|
+
:param pulumi.Input[builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
858
859
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
859
|
-
:param pulumi.Input[bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
860
|
-
:param pulumi.Input[str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
860
|
+
:param pulumi.Input[builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
861
|
+
:param pulumi.Input[builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
861
862
|
Cannot be defined in terms of a volume definition.
|
|
862
863
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
863
|
-
:param pulumi.Input[int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
864
|
-
:param pulumi.Input[str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
864
|
+
:param pulumi.Input[builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
865
|
+
:param pulumi.Input[builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
865
866
|
If specified, it must be defined in terms of a volume definition.
|
|
866
|
-
:param pulumi.Input[str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
867
|
+
:param pulumi.Input[builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
867
868
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
868
869
|
"""
|
|
869
870
|
if acl is not None:
|
|
@@ -959,19 +960,19 @@ class _IndexesState:
|
|
|
959
960
|
|
|
960
961
|
@property
|
|
961
962
|
@pulumi.getter(name="blockSignSize")
|
|
962
|
-
def block_sign_size(self) -> Optional[pulumi.Input[int]]:
|
|
963
|
+
def block_sign_size(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
963
964
|
"""
|
|
964
965
|
Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
965
966
|
"""
|
|
966
967
|
return pulumi.get(self, "block_sign_size")
|
|
967
968
|
|
|
968
969
|
@block_sign_size.setter
|
|
969
|
-
def block_sign_size(self, value: Optional[pulumi.Input[int]]):
|
|
970
|
+
def block_sign_size(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
970
971
|
pulumi.set(self, "block_sign_size", value)
|
|
971
972
|
|
|
972
973
|
@property
|
|
973
974
|
@pulumi.getter(name="bucketRebuildMemoryHint")
|
|
974
|
-
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[str]]:
|
|
975
|
+
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
975
976
|
"""
|
|
976
977
|
Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
977
978
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
@@ -984,24 +985,24 @@ class _IndexesState:
|
|
|
984
985
|
return pulumi.get(self, "bucket_rebuild_memory_hint")
|
|
985
986
|
|
|
986
987
|
@bucket_rebuild_memory_hint.setter
|
|
987
|
-
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[str]]):
|
|
988
|
+
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
988
989
|
pulumi.set(self, "bucket_rebuild_memory_hint", value)
|
|
989
990
|
|
|
990
991
|
@property
|
|
991
992
|
@pulumi.getter(name="coldPath")
|
|
992
|
-
def cold_path(self) -> Optional[pulumi.Input[str]]:
|
|
993
|
+
def cold_path(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
993
994
|
"""
|
|
994
995
|
An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
995
996
|
"""
|
|
996
997
|
return pulumi.get(self, "cold_path")
|
|
997
998
|
|
|
998
999
|
@cold_path.setter
|
|
999
|
-
def cold_path(self, value: Optional[pulumi.Input[str]]):
|
|
1000
|
+
def cold_path(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1000
1001
|
pulumi.set(self, "cold_path", value)
|
|
1001
1002
|
|
|
1002
1003
|
@property
|
|
1003
1004
|
@pulumi.getter(name="coldToFrozenDir")
|
|
1004
|
-
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[str]]:
|
|
1005
|
+
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1005
1006
|
"""
|
|
1006
1007
|
Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1007
1008
|
<br>
|
|
@@ -1015,12 +1016,12 @@ class _IndexesState:
|
|
|
1015
1016
|
return pulumi.get(self, "cold_to_frozen_dir")
|
|
1016
1017
|
|
|
1017
1018
|
@cold_to_frozen_dir.setter
|
|
1018
|
-
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[str]]):
|
|
1019
|
+
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1019
1020
|
pulumi.set(self, "cold_to_frozen_dir", value)
|
|
1020
1021
|
|
|
1021
1022
|
@property
|
|
1022
1023
|
@pulumi.getter(name="coldToFrozenScript")
|
|
1023
|
-
def cold_to_frozen_script(self) -> Optional[pulumi.Input[str]]:
|
|
1024
|
+
def cold_to_frozen_script(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1024
1025
|
"""
|
|
1025
1026
|
Path to the archiving script.
|
|
1026
1027
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
@@ -1030,36 +1031,36 @@ class _IndexesState:
|
|
|
1030
1031
|
return pulumi.get(self, "cold_to_frozen_script")
|
|
1031
1032
|
|
|
1032
1033
|
@cold_to_frozen_script.setter
|
|
1033
|
-
def cold_to_frozen_script(self, value: Optional[pulumi.Input[str]]):
|
|
1034
|
+
def cold_to_frozen_script(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1034
1035
|
pulumi.set(self, "cold_to_frozen_script", value)
|
|
1035
1036
|
|
|
1036
1037
|
@property
|
|
1037
1038
|
@pulumi.getter(name="compressRawdata")
|
|
1038
|
-
def compress_rawdata(self) -> Optional[pulumi.Input[bool]]:
|
|
1039
|
+
def compress_rawdata(self) -> Optional[pulumi.Input[builtins.bool]]:
|
|
1039
1040
|
"""
|
|
1040
1041
|
This parameter is ignored. The splunkd process always compresses raw data.
|
|
1041
1042
|
"""
|
|
1042
1043
|
return pulumi.get(self, "compress_rawdata")
|
|
1043
1044
|
|
|
1044
1045
|
@compress_rawdata.setter
|
|
1045
|
-
def compress_rawdata(self, value: Optional[pulumi.Input[bool]]):
|
|
1046
|
+
def compress_rawdata(self, value: Optional[pulumi.Input[builtins.bool]]):
|
|
1046
1047
|
pulumi.set(self, "compress_rawdata", value)
|
|
1047
1048
|
|
|
1048
1049
|
@property
|
|
1049
1050
|
@pulumi.getter
|
|
1050
|
-
def datatype(self) -> Optional[pulumi.Input[str]]:
|
|
1051
|
+
def datatype(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1051
1052
|
"""
|
|
1052
1053
|
Valid values: (event | metric). Specifies the type of index.
|
|
1053
1054
|
"""
|
|
1054
1055
|
return pulumi.get(self, "datatype")
|
|
1055
1056
|
|
|
1056
1057
|
@datatype.setter
|
|
1057
|
-
def datatype(self, value: Optional[pulumi.Input[str]]):
|
|
1058
|
+
def datatype(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1058
1059
|
pulumi.set(self, "datatype", value)
|
|
1059
1060
|
|
|
1060
1061
|
@property
|
|
1061
1062
|
@pulumi.getter(name="enableOnlineBucketRepair")
|
|
1062
|
-
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[bool]]:
|
|
1063
|
+
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[builtins.bool]]:
|
|
1063
1064
|
"""
|
|
1064
1065
|
Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1065
1066
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
@@ -1067,12 +1068,12 @@ class _IndexesState:
|
|
|
1067
1068
|
return pulumi.get(self, "enable_online_bucket_repair")
|
|
1068
1069
|
|
|
1069
1070
|
@enable_online_bucket_repair.setter
|
|
1070
|
-
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[bool]]):
|
|
1071
|
+
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[builtins.bool]]):
|
|
1071
1072
|
pulumi.set(self, "enable_online_bucket_repair", value)
|
|
1072
1073
|
|
|
1073
1074
|
@property
|
|
1074
1075
|
@pulumi.getter(name="frozenTimePeriodInSecs")
|
|
1075
|
-
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1076
|
+
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1076
1077
|
"""
|
|
1077
1078
|
Number of seconds after which indexed data rolls to frozen.
|
|
1078
1079
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
@@ -1080,12 +1081,12 @@ class _IndexesState:
|
|
|
1080
1081
|
return pulumi.get(self, "frozen_time_period_in_secs")
|
|
1081
1082
|
|
|
1082
1083
|
@frozen_time_period_in_secs.setter
|
|
1083
|
-
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1084
|
+
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1084
1085
|
pulumi.set(self, "frozen_time_period_in_secs", value)
|
|
1085
1086
|
|
|
1086
1087
|
@property
|
|
1087
1088
|
@pulumi.getter(name="homePath")
|
|
1088
|
-
def home_path(self) -> Optional[pulumi.Input[str]]:
|
|
1089
|
+
def home_path(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1089
1090
|
"""
|
|
1090
1091
|
An absolute path that contains the hot and warm buckets for the index.
|
|
1091
1092
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
@@ -1094,12 +1095,12 @@ class _IndexesState:
|
|
|
1094
1095
|
return pulumi.get(self, "home_path")
|
|
1095
1096
|
|
|
1096
1097
|
@home_path.setter
|
|
1097
|
-
def home_path(self, value: Optional[pulumi.Input[str]]):
|
|
1098
|
+
def home_path(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1098
1099
|
pulumi.set(self, "home_path", value)
|
|
1099
1100
|
|
|
1100
1101
|
@property
|
|
1101
1102
|
@pulumi.getter(name="maxBloomBackfillBucketAge")
|
|
1102
|
-
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[str]]:
|
|
1103
|
+
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1103
1104
|
"""
|
|
1104
1105
|
Valid values are: Integer[m|s|h|d].
|
|
1105
1106
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
@@ -1107,12 +1108,12 @@ class _IndexesState:
|
|
|
1107
1108
|
return pulumi.get(self, "max_bloom_backfill_bucket_age")
|
|
1108
1109
|
|
|
1109
1110
|
@max_bloom_backfill_bucket_age.setter
|
|
1110
|
-
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[str]]):
|
|
1111
|
+
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1111
1112
|
pulumi.set(self, "max_bloom_backfill_bucket_age", value)
|
|
1112
1113
|
|
|
1113
1114
|
@property
|
|
1114
1115
|
@pulumi.getter(name="maxConcurrentOptimizes")
|
|
1115
|
-
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[int]]:
|
|
1116
|
+
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1116
1117
|
"""
|
|
1117
1118
|
The number of concurrent optimize processes that can run against a hot bucket.
|
|
1118
1119
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
@@ -1120,12 +1121,12 @@ class _IndexesState:
|
|
|
1120
1121
|
return pulumi.get(self, "max_concurrent_optimizes")
|
|
1121
1122
|
|
|
1122
1123
|
@max_concurrent_optimizes.setter
|
|
1123
|
-
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[int]]):
|
|
1124
|
+
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1124
1125
|
pulumi.set(self, "max_concurrent_optimizes", value)
|
|
1125
1126
|
|
|
1126
1127
|
@property
|
|
1127
1128
|
@pulumi.getter(name="maxDataSize")
|
|
1128
|
-
def max_data_size(self) -> Optional[pulumi.Input[str]]:
|
|
1129
|
+
def max_data_size(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1129
1130
|
"""
|
|
1130
1131
|
The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1131
1132
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
@@ -1133,12 +1134,12 @@ class _IndexesState:
|
|
|
1133
1134
|
return pulumi.get(self, "max_data_size")
|
|
1134
1135
|
|
|
1135
1136
|
@max_data_size.setter
|
|
1136
|
-
def max_data_size(self, value: Optional[pulumi.Input[str]]):
|
|
1137
|
+
def max_data_size(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1137
1138
|
pulumi.set(self, "max_data_size", value)
|
|
1138
1139
|
|
|
1139
1140
|
@property
|
|
1140
1141
|
@pulumi.getter(name="maxHotBuckets")
|
|
1141
|
-
def max_hot_buckets(self) -> Optional[pulumi.Input[int]]:
|
|
1142
|
+
def max_hot_buckets(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1142
1143
|
"""
|
|
1143
1144
|
Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1144
1145
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
@@ -1146,60 +1147,60 @@ class _IndexesState:
|
|
|
1146
1147
|
return pulumi.get(self, "max_hot_buckets")
|
|
1147
1148
|
|
|
1148
1149
|
@max_hot_buckets.setter
|
|
1149
|
-
def max_hot_buckets(self, value: Optional[pulumi.Input[int]]):
|
|
1150
|
+
def max_hot_buckets(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1150
1151
|
pulumi.set(self, "max_hot_buckets", value)
|
|
1151
1152
|
|
|
1152
1153
|
@property
|
|
1153
1154
|
@pulumi.getter(name="maxHotIdleSecs")
|
|
1154
|
-
def max_hot_idle_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1155
|
+
def max_hot_idle_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1155
1156
|
"""
|
|
1156
1157
|
Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1157
1158
|
"""
|
|
1158
1159
|
return pulumi.get(self, "max_hot_idle_secs")
|
|
1159
1160
|
|
|
1160
1161
|
@max_hot_idle_secs.setter
|
|
1161
|
-
def max_hot_idle_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1162
|
+
def max_hot_idle_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1162
1163
|
pulumi.set(self, "max_hot_idle_secs", value)
|
|
1163
1164
|
|
|
1164
1165
|
@property
|
|
1165
1166
|
@pulumi.getter(name="maxHotSpanSecs")
|
|
1166
|
-
def max_hot_span_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1167
|
+
def max_hot_span_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1167
1168
|
"""
|
|
1168
1169
|
Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1169
1170
|
"""
|
|
1170
1171
|
return pulumi.get(self, "max_hot_span_secs")
|
|
1171
1172
|
|
|
1172
1173
|
@max_hot_span_secs.setter
|
|
1173
|
-
def max_hot_span_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1174
|
+
def max_hot_span_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1174
1175
|
pulumi.set(self, "max_hot_span_secs", value)
|
|
1175
1176
|
|
|
1176
1177
|
@property
|
|
1177
1178
|
@pulumi.getter(name="maxMemMb")
|
|
1178
|
-
def max_mem_mb(self) -> Optional[pulumi.Input[int]]:
|
|
1179
|
+
def max_mem_mb(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1179
1180
|
"""
|
|
1180
1181
|
The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1181
1182
|
"""
|
|
1182
1183
|
return pulumi.get(self, "max_mem_mb")
|
|
1183
1184
|
|
|
1184
1185
|
@max_mem_mb.setter
|
|
1185
|
-
def max_mem_mb(self, value: Optional[pulumi.Input[int]]):
|
|
1186
|
+
def max_mem_mb(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1186
1187
|
pulumi.set(self, "max_mem_mb", value)
|
|
1187
1188
|
|
|
1188
1189
|
@property
|
|
1189
1190
|
@pulumi.getter(name="maxMetaEntries")
|
|
1190
|
-
def max_meta_entries(self) -> Optional[pulumi.Input[int]]:
|
|
1191
|
+
def max_meta_entries(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1191
1192
|
"""
|
|
1192
1193
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1193
1194
|
"""
|
|
1194
1195
|
return pulumi.get(self, "max_meta_entries")
|
|
1195
1196
|
|
|
1196
1197
|
@max_meta_entries.setter
|
|
1197
|
-
def max_meta_entries(self, value: Optional[pulumi.Input[int]]):
|
|
1198
|
+
def max_meta_entries(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1198
1199
|
pulumi.set(self, "max_meta_entries", value)
|
|
1199
1200
|
|
|
1200
1201
|
@property
|
|
1201
1202
|
@pulumi.getter(name="maxTimeUnreplicatedNoAcks")
|
|
1202
|
-
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[int]]:
|
|
1203
|
+
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1203
1204
|
"""
|
|
1204
1205
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1205
1206
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
@@ -1208,12 +1209,12 @@ class _IndexesState:
|
|
|
1208
1209
|
return pulumi.get(self, "max_time_unreplicated_no_acks")
|
|
1209
1210
|
|
|
1210
1211
|
@max_time_unreplicated_no_acks.setter
|
|
1211
|
-
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[int]]):
|
|
1212
|
+
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1212
1213
|
pulumi.set(self, "max_time_unreplicated_no_acks", value)
|
|
1213
1214
|
|
|
1214
1215
|
@property
|
|
1215
1216
|
@pulumi.getter(name="maxTimeUnreplicatedWithAcks")
|
|
1216
|
-
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[int]]:
|
|
1217
|
+
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1217
1218
|
"""
|
|
1218
1219
|
Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1219
1220
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
@@ -1222,36 +1223,36 @@ class _IndexesState:
|
|
|
1222
1223
|
return pulumi.get(self, "max_time_unreplicated_with_acks")
|
|
1223
1224
|
|
|
1224
1225
|
@max_time_unreplicated_with_acks.setter
|
|
1225
|
-
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[int]]):
|
|
1226
|
+
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1226
1227
|
pulumi.set(self, "max_time_unreplicated_with_acks", value)
|
|
1227
1228
|
|
|
1228
1229
|
@property
|
|
1229
1230
|
@pulumi.getter(name="maxTotalDataSizeMb")
|
|
1230
|
-
def max_total_data_size_mb(self) -> Optional[pulumi.Input[int]]:
|
|
1231
|
+
def max_total_data_size_mb(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1231
1232
|
"""
|
|
1232
1233
|
The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1233
1234
|
"""
|
|
1234
1235
|
return pulumi.get(self, "max_total_data_size_mb")
|
|
1235
1236
|
|
|
1236
1237
|
@max_total_data_size_mb.setter
|
|
1237
|
-
def max_total_data_size_mb(self, value: Optional[pulumi.Input[int]]):
|
|
1238
|
+
def max_total_data_size_mb(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1238
1239
|
pulumi.set(self, "max_total_data_size_mb", value)
|
|
1239
1240
|
|
|
1240
1241
|
@property
|
|
1241
1242
|
@pulumi.getter(name="maxWarmDbCount")
|
|
1242
|
-
def max_warm_db_count(self) -> Optional[pulumi.Input[int]]:
|
|
1243
|
+
def max_warm_db_count(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1243
1244
|
"""
|
|
1244
1245
|
The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1245
1246
|
"""
|
|
1246
1247
|
return pulumi.get(self, "max_warm_db_count")
|
|
1247
1248
|
|
|
1248
1249
|
@max_warm_db_count.setter
|
|
1249
|
-
def max_warm_db_count(self, value: Optional[pulumi.Input[int]]):
|
|
1250
|
+
def max_warm_db_count(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1250
1251
|
pulumi.set(self, "max_warm_db_count", value)
|
|
1251
1252
|
|
|
1252
1253
|
@property
|
|
1253
1254
|
@pulumi.getter(name="minRawFileSyncSecs")
|
|
1254
|
-
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[str]]:
|
|
1255
|
+
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1255
1256
|
"""
|
|
1256
1257
|
Specify an integer (or "disable") for this parameter.
|
|
1257
1258
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
@@ -1261,36 +1262,36 @@ class _IndexesState:
|
|
|
1261
1262
|
return pulumi.get(self, "min_raw_file_sync_secs")
|
|
1262
1263
|
|
|
1263
1264
|
@min_raw_file_sync_secs.setter
|
|
1264
|
-
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[str]]):
|
|
1265
|
+
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1265
1266
|
pulumi.set(self, "min_raw_file_sync_secs", value)
|
|
1266
1267
|
|
|
1267
1268
|
@property
|
|
1268
1269
|
@pulumi.getter(name="minStreamGroupQueueSize")
|
|
1269
|
-
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[int]]:
|
|
1270
|
+
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1270
1271
|
"""
|
|
1271
1272
|
Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1272
1273
|
"""
|
|
1273
1274
|
return pulumi.get(self, "min_stream_group_queue_size")
|
|
1274
1275
|
|
|
1275
1276
|
@min_stream_group_queue_size.setter
|
|
1276
|
-
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[int]]):
|
|
1277
|
+
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1277
1278
|
pulumi.set(self, "min_stream_group_queue_size", value)
|
|
1278
1279
|
|
|
1279
1280
|
@property
|
|
1280
1281
|
@pulumi.getter
|
|
1281
|
-
def name(self) -> Optional[pulumi.Input[str]]:
|
|
1282
|
+
def name(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1282
1283
|
"""
|
|
1283
1284
|
The name of the index to create.
|
|
1284
1285
|
"""
|
|
1285
1286
|
return pulumi.get(self, "name")
|
|
1286
1287
|
|
|
1287
1288
|
@name.setter
|
|
1288
|
-
def name(self, value: Optional[pulumi.Input[str]]):
|
|
1289
|
+
def name(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1289
1290
|
pulumi.set(self, "name", value)
|
|
1290
1291
|
|
|
1291
1292
|
@property
|
|
1292
1293
|
@pulumi.getter(name="partialServiceMetaPeriod")
|
|
1293
|
-
def partial_service_meta_period(self) -> Optional[pulumi.Input[int]]:
|
|
1294
|
+
def partial_service_meta_period(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1294
1295
|
"""
|
|
1295
1296
|
Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1296
1297
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
@@ -1300,12 +1301,12 @@ class _IndexesState:
|
|
|
1300
1301
|
return pulumi.get(self, "partial_service_meta_period")
|
|
1301
1302
|
|
|
1302
1303
|
@partial_service_meta_period.setter
|
|
1303
|
-
def partial_service_meta_period(self, value: Optional[pulumi.Input[int]]):
|
|
1304
|
+
def partial_service_meta_period(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1304
1305
|
pulumi.set(self, "partial_service_meta_period", value)
|
|
1305
1306
|
|
|
1306
1307
|
@property
|
|
1307
1308
|
@pulumi.getter(name="processTrackerServiceInterval")
|
|
1308
|
-
def process_tracker_service_interval(self) -> Optional[pulumi.Input[int]]:
|
|
1309
|
+
def process_tracker_service_interval(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1309
1310
|
"""
|
|
1310
1311
|
Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1311
1312
|
If set to 0, the indexer checks child process status every second.
|
|
@@ -1314,12 +1315,12 @@ class _IndexesState:
|
|
|
1314
1315
|
return pulumi.get(self, "process_tracker_service_interval")
|
|
1315
1316
|
|
|
1316
1317
|
@process_tracker_service_interval.setter
|
|
1317
|
-
def process_tracker_service_interval(self, value: Optional[pulumi.Input[int]]):
|
|
1318
|
+
def process_tracker_service_interval(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1318
1319
|
pulumi.set(self, "process_tracker_service_interval", value)
|
|
1319
1320
|
|
|
1320
1321
|
@property
|
|
1321
1322
|
@pulumi.getter(name="quarantineFutureSecs")
|
|
1322
|
-
def quarantine_future_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1323
|
+
def quarantine_future_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1323
1324
|
"""
|
|
1324
1325
|
Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1325
1326
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
@@ -1327,36 +1328,36 @@ class _IndexesState:
|
|
|
1327
1328
|
return pulumi.get(self, "quarantine_future_secs")
|
|
1328
1329
|
|
|
1329
1330
|
@quarantine_future_secs.setter
|
|
1330
|
-
def quarantine_future_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1331
|
+
def quarantine_future_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1331
1332
|
pulumi.set(self, "quarantine_future_secs", value)
|
|
1332
1333
|
|
|
1333
1334
|
@property
|
|
1334
1335
|
@pulumi.getter(name="quarantinePastSecs")
|
|
1335
|
-
def quarantine_past_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1336
|
+
def quarantine_past_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1336
1337
|
"""
|
|
1337
1338
|
Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1338
1339
|
"""
|
|
1339
1340
|
return pulumi.get(self, "quarantine_past_secs")
|
|
1340
1341
|
|
|
1341
1342
|
@quarantine_past_secs.setter
|
|
1342
|
-
def quarantine_past_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1343
|
+
def quarantine_past_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1343
1344
|
pulumi.set(self, "quarantine_past_secs", value)
|
|
1344
1345
|
|
|
1345
1346
|
@property
|
|
1346
1347
|
@pulumi.getter(name="rawChunkSizeBytes")
|
|
1347
|
-
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[int]]:
|
|
1348
|
+
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1348
1349
|
"""
|
|
1349
1350
|
Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1350
1351
|
"""
|
|
1351
1352
|
return pulumi.get(self, "raw_chunk_size_bytes")
|
|
1352
1353
|
|
|
1353
1354
|
@raw_chunk_size_bytes.setter
|
|
1354
|
-
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[int]]):
|
|
1355
|
+
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1355
1356
|
pulumi.set(self, "raw_chunk_size_bytes", value)
|
|
1356
1357
|
|
|
1357
1358
|
@property
|
|
1358
1359
|
@pulumi.getter(name="repFactor")
|
|
1359
|
-
def rep_factor(self) -> Optional[pulumi.Input[str]]:
|
|
1360
|
+
def rep_factor(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1360
1361
|
"""
|
|
1361
1362
|
Index replication control. This parameter applies to only clustering slaves.
|
|
1362
1363
|
auto = Use the master index replication configuration value.
|
|
@@ -1365,24 +1366,24 @@ class _IndexesState:
|
|
|
1365
1366
|
return pulumi.get(self, "rep_factor")
|
|
1366
1367
|
|
|
1367
1368
|
@rep_factor.setter
|
|
1368
|
-
def rep_factor(self, value: Optional[pulumi.Input[str]]):
|
|
1369
|
+
def rep_factor(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1369
1370
|
pulumi.set(self, "rep_factor", value)
|
|
1370
1371
|
|
|
1371
1372
|
@property
|
|
1372
1373
|
@pulumi.getter(name="rotatePeriodInSecs")
|
|
1373
|
-
def rotate_period_in_secs(self) -> Optional[pulumi.Input[int]]:
|
|
1374
|
+
def rotate_period_in_secs(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1374
1375
|
"""
|
|
1375
1376
|
How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1376
1377
|
"""
|
|
1377
1378
|
return pulumi.get(self, "rotate_period_in_secs")
|
|
1378
1379
|
|
|
1379
1380
|
@rotate_period_in_secs.setter
|
|
1380
|
-
def rotate_period_in_secs(self, value: Optional[pulumi.Input[int]]):
|
|
1381
|
+
def rotate_period_in_secs(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1381
1382
|
pulumi.set(self, "rotate_period_in_secs", value)
|
|
1382
1383
|
|
|
1383
1384
|
@property
|
|
1384
1385
|
@pulumi.getter(name="serviceMetaPeriod")
|
|
1385
|
-
def service_meta_period(self) -> Optional[pulumi.Input[int]]:
|
|
1386
|
+
def service_meta_period(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1386
1387
|
"""
|
|
1387
1388
|
Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1388
1389
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
@@ -1390,24 +1391,24 @@ class _IndexesState:
|
|
|
1390
1391
|
return pulumi.get(self, "service_meta_period")
|
|
1391
1392
|
|
|
1392
1393
|
@service_meta_period.setter
|
|
1393
|
-
def service_meta_period(self, value: Optional[pulumi.Input[int]]):
|
|
1394
|
+
def service_meta_period(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1394
1395
|
pulumi.set(self, "service_meta_period", value)
|
|
1395
1396
|
|
|
1396
1397
|
@property
|
|
1397
1398
|
@pulumi.getter(name="syncMeta")
|
|
1398
|
-
def sync_meta(self) -> Optional[pulumi.Input[bool]]:
|
|
1399
|
+
def sync_meta(self) -> Optional[pulumi.Input[builtins.bool]]:
|
|
1399
1400
|
"""
|
|
1400
1401
|
When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1401
1402
|
"""
|
|
1402
1403
|
return pulumi.get(self, "sync_meta")
|
|
1403
1404
|
|
|
1404
1405
|
@sync_meta.setter
|
|
1405
|
-
def sync_meta(self, value: Optional[pulumi.Input[bool]]):
|
|
1406
|
+
def sync_meta(self, value: Optional[pulumi.Input[builtins.bool]]):
|
|
1406
1407
|
pulumi.set(self, "sync_meta", value)
|
|
1407
1408
|
|
|
1408
1409
|
@property
|
|
1409
1410
|
@pulumi.getter(name="thawedPath")
|
|
1410
|
-
def thawed_path(self) -> Optional[pulumi.Input[str]]:
|
|
1411
|
+
def thawed_path(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1411
1412
|
"""
|
|
1412
1413
|
An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1413
1414
|
Cannot be defined in terms of a volume definition.
|
|
@@ -1416,24 +1417,24 @@ class _IndexesState:
|
|
|
1416
1417
|
return pulumi.get(self, "thawed_path")
|
|
1417
1418
|
|
|
1418
1419
|
@thawed_path.setter
|
|
1419
|
-
def thawed_path(self, value: Optional[pulumi.Input[str]]):
|
|
1420
|
+
def thawed_path(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1420
1421
|
pulumi.set(self, "thawed_path", value)
|
|
1421
1422
|
|
|
1422
1423
|
@property
|
|
1423
1424
|
@pulumi.getter(name="throttleCheckPeriod")
|
|
1424
|
-
def throttle_check_period(self) -> Optional[pulumi.Input[int]]:
|
|
1425
|
+
def throttle_check_period(self) -> Optional[pulumi.Input[builtins.int]]:
|
|
1425
1426
|
"""
|
|
1426
1427
|
Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1427
1428
|
"""
|
|
1428
1429
|
return pulumi.get(self, "throttle_check_period")
|
|
1429
1430
|
|
|
1430
1431
|
@throttle_check_period.setter
|
|
1431
|
-
def throttle_check_period(self, value: Optional[pulumi.Input[int]]):
|
|
1432
|
+
def throttle_check_period(self, value: Optional[pulumi.Input[builtins.int]]):
|
|
1432
1433
|
pulumi.set(self, "throttle_check_period", value)
|
|
1433
1434
|
|
|
1434
1435
|
@property
|
|
1435
1436
|
@pulumi.getter(name="tstatsHomePath")
|
|
1436
|
-
def tstats_home_path(self) -> Optional[pulumi.Input[str]]:
|
|
1437
|
+
def tstats_home_path(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1437
1438
|
"""
|
|
1438
1439
|
Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1439
1440
|
If specified, it must be defined in terms of a volume definition.
|
|
@@ -1441,12 +1442,12 @@ class _IndexesState:
|
|
|
1441
1442
|
return pulumi.get(self, "tstats_home_path")
|
|
1442
1443
|
|
|
1443
1444
|
@tstats_home_path.setter
|
|
1444
|
-
def tstats_home_path(self, value: Optional[pulumi.Input[str]]):
|
|
1445
|
+
def tstats_home_path(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1445
1446
|
pulumi.set(self, "tstats_home_path", value)
|
|
1446
1447
|
|
|
1447
1448
|
@property
|
|
1448
1449
|
@pulumi.getter(name="warmToColdScript")
|
|
1449
|
-
def warm_to_cold_script(self) -> Optional[pulumi.Input[str]]:
|
|
1450
|
+
def warm_to_cold_script(self) -> Optional[pulumi.Input[builtins.str]]:
|
|
1450
1451
|
"""
|
|
1451
1452
|
Path to a script to run when moving data from warm to cold.
|
|
1452
1453
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
@@ -1454,7 +1455,7 @@ class _IndexesState:
|
|
|
1454
1455
|
return pulumi.get(self, "warm_to_cold_script")
|
|
1455
1456
|
|
|
1456
1457
|
@warm_to_cold_script.setter
|
|
1457
|
-
def warm_to_cold_script(self, value: Optional[pulumi.Input[str]]):
|
|
1458
|
+
def warm_to_cold_script(self, value: Optional[pulumi.Input[builtins.str]]):
|
|
1458
1459
|
pulumi.set(self, "warm_to_cold_script", value)
|
|
1459
1460
|
|
|
1460
1461
|
|
|
@@ -1464,44 +1465,44 @@ class Indexes(pulumi.CustomResource):
|
|
|
1464
1465
|
resource_name: str,
|
|
1465
1466
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1466
1467
|
acl: Optional[pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']]] = None,
|
|
1467
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
1468
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
1469
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
1470
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
1471
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
1472
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
1473
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
1474
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
1475
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1476
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
1477
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
1478
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
1479
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
1480
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
1481
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
1482
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
1483
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
1484
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
1485
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
1486
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
1487
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
1488
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
1489
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
1490
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
1491
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
1492
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1493
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
1494
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
1495
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
1496
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
1497
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
1498
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1499
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1500
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
1501
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
1502
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
1503
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
1504
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None,
|
|
1468
|
+
block_sign_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
1469
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[builtins.str]] = None,
|
|
1470
|
+
cold_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1471
|
+
cold_to_frozen_dir: Optional[pulumi.Input[builtins.str]] = None,
|
|
1472
|
+
cold_to_frozen_script: Optional[pulumi.Input[builtins.str]] = None,
|
|
1473
|
+
compress_rawdata: Optional[pulumi.Input[builtins.bool]] = None,
|
|
1474
|
+
datatype: Optional[pulumi.Input[builtins.str]] = None,
|
|
1475
|
+
enable_online_bucket_repair: Optional[pulumi.Input[builtins.bool]] = None,
|
|
1476
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1477
|
+
home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1478
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[builtins.str]] = None,
|
|
1479
|
+
max_concurrent_optimizes: Optional[pulumi.Input[builtins.int]] = None,
|
|
1480
|
+
max_data_size: Optional[pulumi.Input[builtins.str]] = None,
|
|
1481
|
+
max_hot_buckets: Optional[pulumi.Input[builtins.int]] = None,
|
|
1482
|
+
max_hot_idle_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1483
|
+
max_hot_span_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1484
|
+
max_mem_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
1485
|
+
max_meta_entries: Optional[pulumi.Input[builtins.int]] = None,
|
|
1486
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
1487
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
1488
|
+
max_total_data_size_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
1489
|
+
max_warm_db_count: Optional[pulumi.Input[builtins.int]] = None,
|
|
1490
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[builtins.str]] = None,
|
|
1491
|
+
min_stream_group_queue_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
1492
|
+
name: Optional[pulumi.Input[builtins.str]] = None,
|
|
1493
|
+
partial_service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
1494
|
+
process_tracker_service_interval: Optional[pulumi.Input[builtins.int]] = None,
|
|
1495
|
+
quarantine_future_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1496
|
+
quarantine_past_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1497
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[builtins.int]] = None,
|
|
1498
|
+
rep_factor: Optional[pulumi.Input[builtins.str]] = None,
|
|
1499
|
+
rotate_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1500
|
+
service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
1501
|
+
sync_meta: Optional[pulumi.Input[builtins.bool]] = None,
|
|
1502
|
+
thawed_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1503
|
+
throttle_check_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
1504
|
+
tstats_home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1505
|
+
warm_to_cold_script: Optional[pulumi.Input[builtins.str]] = None,
|
|
1505
1506
|
__props__=None):
|
|
1506
1507
|
"""
|
|
1507
1508
|
## # Resource: Indexes
|
|
@@ -1528,16 +1529,16 @@ class Indexes(pulumi.CustomResource):
|
|
|
1528
1529
|
:param str resource_name: The name of the resource.
|
|
1529
1530
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1530
1531
|
:param pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']] acl: The app/user context that is the namespace for the resource
|
|
1531
|
-
:param pulumi.Input[int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1532
|
-
:param pulumi.Input[str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1532
|
+
:param pulumi.Input[builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1533
|
+
:param pulumi.Input[builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1533
1534
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
1534
1535
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
1535
1536
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
1536
1537
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
1537
1538
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
1538
1539
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
1539
|
-
:param pulumi.Input[str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1540
|
-
:param pulumi.Input[str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1540
|
+
:param pulumi.Input[builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1541
|
+
:param pulumi.Input[builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1541
1542
|
<br>
|
|
1542
1543
|
Bucket freezing policy is as follows:<br>
|
|
1543
1544
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -1545,70 +1546,70 @@ class Indexes(pulumi.CustomResource):
|
|
|
1545
1546
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
1546
1547
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
1547
1548
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
1548
|
-
:param pulumi.Input[str] cold_to_frozen_script: Path to the archiving script.
|
|
1549
|
+
:param pulumi.Input[builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
1549
1550
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
1550
1551
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
1551
1552
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
1552
|
-
:param pulumi.Input[bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1553
|
-
:param pulumi.Input[str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1554
|
-
:param pulumi.Input[bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1553
|
+
:param pulumi.Input[builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1554
|
+
:param pulumi.Input[builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1555
|
+
:param pulumi.Input[builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1555
1556
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
1556
|
-
:param pulumi.Input[int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1557
|
+
:param pulumi.Input[builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1557
1558
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
1558
|
-
:param pulumi.Input[str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1559
|
+
:param pulumi.Input[builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1559
1560
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
1560
1561
|
<br>Caution: The path must be readable and writable.
|
|
1561
|
-
:param pulumi.Input[str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1562
|
+
:param pulumi.Input[builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1562
1563
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
1563
|
-
:param pulumi.Input[int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1564
|
+
:param pulumi.Input[builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1564
1565
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
1565
|
-
:param pulumi.Input[str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1566
|
+
:param pulumi.Input[builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1566
1567
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
1567
|
-
:param pulumi.Input[int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1568
|
+
:param pulumi.Input[builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1568
1569
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
1569
|
-
:param pulumi.Input[int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1570
|
-
:param pulumi.Input[int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1571
|
-
:param pulumi.Input[int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1572
|
-
:param pulumi.Input[int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1573
|
-
:param pulumi.Input[int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1570
|
+
:param pulumi.Input[builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1571
|
+
:param pulumi.Input[builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1572
|
+
:param pulumi.Input[builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1573
|
+
:param pulumi.Input[builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1574
|
+
:param pulumi.Input[builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1574
1575
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
1575
1576
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1576
|
-
:param pulumi.Input[int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1577
|
+
:param pulumi.Input[builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1577
1578
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
1578
1579
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
1579
|
-
:param pulumi.Input[int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1580
|
-
:param pulumi.Input[int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1581
|
-
:param pulumi.Input[str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1580
|
+
:param pulumi.Input[builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1581
|
+
:param pulumi.Input[builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1582
|
+
:param pulumi.Input[builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1582
1583
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
1583
1584
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
1584
1585
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
1585
|
-
:param pulumi.Input[int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1586
|
-
:param pulumi.Input[str] name: The name of the index to create.
|
|
1587
|
-
:param pulumi.Input[int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1586
|
+
:param pulumi.Input[builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1587
|
+
:param pulumi.Input[builtins.str] name: The name of the index to create.
|
|
1588
|
+
:param pulumi.Input[builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1588
1589
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
1589
1590
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
1590
1591
|
By default it is turned off (zero).
|
|
1591
|
-
:param pulumi.Input[int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1592
|
+
:param pulumi.Input[builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1592
1593
|
If set to 0, the indexer checks child process status every second.
|
|
1593
1594
|
Highest legal value is 4294967295.
|
|
1594
|
-
:param pulumi.Input[int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1595
|
+
:param pulumi.Input[builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1595
1596
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
1596
|
-
:param pulumi.Input[int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1597
|
-
:param pulumi.Input[int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1598
|
-
:param pulumi.Input[str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1597
|
+
:param pulumi.Input[builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1598
|
+
:param pulumi.Input[builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1599
|
+
:param pulumi.Input[builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1599
1600
|
auto = Use the master index replication configuration value.
|
|
1600
1601
|
0 = Turn off replication for this index.
|
|
1601
|
-
:param pulumi.Input[int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1602
|
-
:param pulumi.Input[int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1602
|
+
:param pulumi.Input[builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1603
|
+
:param pulumi.Input[builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1603
1604
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
1604
|
-
:param pulumi.Input[bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1605
|
-
:param pulumi.Input[str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1605
|
+
:param pulumi.Input[builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1606
|
+
:param pulumi.Input[builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1606
1607
|
Cannot be defined in terms of a volume definition.
|
|
1607
1608
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
1608
|
-
:param pulumi.Input[int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1609
|
-
:param pulumi.Input[str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1609
|
+
:param pulumi.Input[builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1610
|
+
:param pulumi.Input[builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1610
1611
|
If specified, it must be defined in terms of a volume definition.
|
|
1611
|
-
:param pulumi.Input[str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1612
|
+
:param pulumi.Input[builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1612
1613
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
1613
1614
|
"""
|
|
1614
1615
|
...
|
|
@@ -1655,44 +1656,44 @@ class Indexes(pulumi.CustomResource):
|
|
|
1655
1656
|
resource_name: str,
|
|
1656
1657
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1657
1658
|
acl: Optional[pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']]] = None,
|
|
1658
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
1659
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
1660
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
1661
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
1662
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
1663
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
1664
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
1665
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
1666
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1667
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
1668
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
1669
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
1670
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
1671
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
1672
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
1673
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
1674
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
1675
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
1676
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
1677
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
1678
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
1679
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
1680
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
1681
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
1682
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
1683
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1684
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
1685
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
1686
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
1687
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
1688
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
1689
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1690
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1691
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
1692
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
1693
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
1694
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
1695
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None,
|
|
1659
|
+
block_sign_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
1660
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[builtins.str]] = None,
|
|
1661
|
+
cold_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1662
|
+
cold_to_frozen_dir: Optional[pulumi.Input[builtins.str]] = None,
|
|
1663
|
+
cold_to_frozen_script: Optional[pulumi.Input[builtins.str]] = None,
|
|
1664
|
+
compress_rawdata: Optional[pulumi.Input[builtins.bool]] = None,
|
|
1665
|
+
datatype: Optional[pulumi.Input[builtins.str]] = None,
|
|
1666
|
+
enable_online_bucket_repair: Optional[pulumi.Input[builtins.bool]] = None,
|
|
1667
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1668
|
+
home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1669
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[builtins.str]] = None,
|
|
1670
|
+
max_concurrent_optimizes: Optional[pulumi.Input[builtins.int]] = None,
|
|
1671
|
+
max_data_size: Optional[pulumi.Input[builtins.str]] = None,
|
|
1672
|
+
max_hot_buckets: Optional[pulumi.Input[builtins.int]] = None,
|
|
1673
|
+
max_hot_idle_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1674
|
+
max_hot_span_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1675
|
+
max_mem_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
1676
|
+
max_meta_entries: Optional[pulumi.Input[builtins.int]] = None,
|
|
1677
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
1678
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
1679
|
+
max_total_data_size_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
1680
|
+
max_warm_db_count: Optional[pulumi.Input[builtins.int]] = None,
|
|
1681
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[builtins.str]] = None,
|
|
1682
|
+
min_stream_group_queue_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
1683
|
+
name: Optional[pulumi.Input[builtins.str]] = None,
|
|
1684
|
+
partial_service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
1685
|
+
process_tracker_service_interval: Optional[pulumi.Input[builtins.int]] = None,
|
|
1686
|
+
quarantine_future_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1687
|
+
quarantine_past_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1688
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[builtins.int]] = None,
|
|
1689
|
+
rep_factor: Optional[pulumi.Input[builtins.str]] = None,
|
|
1690
|
+
rotate_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1691
|
+
service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
1692
|
+
sync_meta: Optional[pulumi.Input[builtins.bool]] = None,
|
|
1693
|
+
thawed_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1694
|
+
throttle_check_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
1695
|
+
tstats_home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1696
|
+
warm_to_cold_script: Optional[pulumi.Input[builtins.str]] = None,
|
|
1696
1697
|
__props__=None):
|
|
1697
1698
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
1698
1699
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -1752,44 +1753,44 @@ class Indexes(pulumi.CustomResource):
|
|
|
1752
1753
|
id: pulumi.Input[str],
|
|
1753
1754
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1754
1755
|
acl: Optional[pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']]] = None,
|
|
1755
|
-
block_sign_size: Optional[pulumi.Input[int]] = None,
|
|
1756
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[str]] = None,
|
|
1757
|
-
cold_path: Optional[pulumi.Input[str]] = None,
|
|
1758
|
-
cold_to_frozen_dir: Optional[pulumi.Input[str]] = None,
|
|
1759
|
-
cold_to_frozen_script: Optional[pulumi.Input[str]] = None,
|
|
1760
|
-
compress_rawdata: Optional[pulumi.Input[bool]] = None,
|
|
1761
|
-
datatype: Optional[pulumi.Input[str]] = None,
|
|
1762
|
-
enable_online_bucket_repair: Optional[pulumi.Input[bool]] = None,
|
|
1763
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1764
|
-
home_path: Optional[pulumi.Input[str]] = None,
|
|
1765
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[str]] = None,
|
|
1766
|
-
max_concurrent_optimizes: Optional[pulumi.Input[int]] = None,
|
|
1767
|
-
max_data_size: Optional[pulumi.Input[str]] = None,
|
|
1768
|
-
max_hot_buckets: Optional[pulumi.Input[int]] = None,
|
|
1769
|
-
max_hot_idle_secs: Optional[pulumi.Input[int]] = None,
|
|
1770
|
-
max_hot_span_secs: Optional[pulumi.Input[int]] = None,
|
|
1771
|
-
max_mem_mb: Optional[pulumi.Input[int]] = None,
|
|
1772
|
-
max_meta_entries: Optional[pulumi.Input[int]] = None,
|
|
1773
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[int]] = None,
|
|
1774
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[int]] = None,
|
|
1775
|
-
max_total_data_size_mb: Optional[pulumi.Input[int]] = None,
|
|
1776
|
-
max_warm_db_count: Optional[pulumi.Input[int]] = None,
|
|
1777
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[str]] = None,
|
|
1778
|
-
min_stream_group_queue_size: Optional[pulumi.Input[int]] = None,
|
|
1779
|
-
name: Optional[pulumi.Input[str]] = None,
|
|
1780
|
-
partial_service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1781
|
-
process_tracker_service_interval: Optional[pulumi.Input[int]] = None,
|
|
1782
|
-
quarantine_future_secs: Optional[pulumi.Input[int]] = None,
|
|
1783
|
-
quarantine_past_secs: Optional[pulumi.Input[int]] = None,
|
|
1784
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[int]] = None,
|
|
1785
|
-
rep_factor: Optional[pulumi.Input[str]] = None,
|
|
1786
|
-
rotate_period_in_secs: Optional[pulumi.Input[int]] = None,
|
|
1787
|
-
service_meta_period: Optional[pulumi.Input[int]] = None,
|
|
1788
|
-
sync_meta: Optional[pulumi.Input[bool]] = None,
|
|
1789
|
-
thawed_path: Optional[pulumi.Input[str]] = None,
|
|
1790
|
-
throttle_check_period: Optional[pulumi.Input[int]] = None,
|
|
1791
|
-
tstats_home_path: Optional[pulumi.Input[str]] = None,
|
|
1792
|
-
warm_to_cold_script: Optional[pulumi.Input[str]] = None) -> 'Indexes':
|
|
1756
|
+
block_sign_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
1757
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[builtins.str]] = None,
|
|
1758
|
+
cold_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1759
|
+
cold_to_frozen_dir: Optional[pulumi.Input[builtins.str]] = None,
|
|
1760
|
+
cold_to_frozen_script: Optional[pulumi.Input[builtins.str]] = None,
|
|
1761
|
+
compress_rawdata: Optional[pulumi.Input[builtins.bool]] = None,
|
|
1762
|
+
datatype: Optional[pulumi.Input[builtins.str]] = None,
|
|
1763
|
+
enable_online_bucket_repair: Optional[pulumi.Input[builtins.bool]] = None,
|
|
1764
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1765
|
+
home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1766
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[builtins.str]] = None,
|
|
1767
|
+
max_concurrent_optimizes: Optional[pulumi.Input[builtins.int]] = None,
|
|
1768
|
+
max_data_size: Optional[pulumi.Input[builtins.str]] = None,
|
|
1769
|
+
max_hot_buckets: Optional[pulumi.Input[builtins.int]] = None,
|
|
1770
|
+
max_hot_idle_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1771
|
+
max_hot_span_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1772
|
+
max_mem_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
1773
|
+
max_meta_entries: Optional[pulumi.Input[builtins.int]] = None,
|
|
1774
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
1775
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[builtins.int]] = None,
|
|
1776
|
+
max_total_data_size_mb: Optional[pulumi.Input[builtins.int]] = None,
|
|
1777
|
+
max_warm_db_count: Optional[pulumi.Input[builtins.int]] = None,
|
|
1778
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[builtins.str]] = None,
|
|
1779
|
+
min_stream_group_queue_size: Optional[pulumi.Input[builtins.int]] = None,
|
|
1780
|
+
name: Optional[pulumi.Input[builtins.str]] = None,
|
|
1781
|
+
partial_service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
1782
|
+
process_tracker_service_interval: Optional[pulumi.Input[builtins.int]] = None,
|
|
1783
|
+
quarantine_future_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1784
|
+
quarantine_past_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1785
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[builtins.int]] = None,
|
|
1786
|
+
rep_factor: Optional[pulumi.Input[builtins.str]] = None,
|
|
1787
|
+
rotate_period_in_secs: Optional[pulumi.Input[builtins.int]] = None,
|
|
1788
|
+
service_meta_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
1789
|
+
sync_meta: Optional[pulumi.Input[builtins.bool]] = None,
|
|
1790
|
+
thawed_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1791
|
+
throttle_check_period: Optional[pulumi.Input[builtins.int]] = None,
|
|
1792
|
+
tstats_home_path: Optional[pulumi.Input[builtins.str]] = None,
|
|
1793
|
+
warm_to_cold_script: Optional[pulumi.Input[builtins.str]] = None) -> 'Indexes':
|
|
1793
1794
|
"""
|
|
1794
1795
|
Get an existing Indexes resource's state with the given name, id, and optional extra
|
|
1795
1796
|
properties used to qualify the lookup.
|
|
@@ -1798,16 +1799,16 @@ class Indexes(pulumi.CustomResource):
|
|
|
1798
1799
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
1799
1800
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1800
1801
|
:param pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']] acl: The app/user context that is the namespace for the resource
|
|
1801
|
-
:param pulumi.Input[int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1802
|
-
:param pulumi.Input[str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1802
|
+
:param pulumi.Input[builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1803
|
+
:param pulumi.Input[builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1803
1804
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
1804
1805
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
1805
1806
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
1806
1807
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
1807
1808
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
1808
1809
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
1809
|
-
:param pulumi.Input[str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1810
|
-
:param pulumi.Input[str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1810
|
+
:param pulumi.Input[builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1811
|
+
:param pulumi.Input[builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1811
1812
|
<br>
|
|
1812
1813
|
Bucket freezing policy is as follows:<br>
|
|
1813
1814
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -1815,70 +1816,70 @@ class Indexes(pulumi.CustomResource):
|
|
|
1815
1816
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
1816
1817
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
1817
1818
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
1818
|
-
:param pulumi.Input[str] cold_to_frozen_script: Path to the archiving script.
|
|
1819
|
+
:param pulumi.Input[builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
1819
1820
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
1820
1821
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
1821
1822
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
1822
|
-
:param pulumi.Input[bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1823
|
-
:param pulumi.Input[str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1824
|
-
:param pulumi.Input[bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1823
|
+
:param pulumi.Input[builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1824
|
+
:param pulumi.Input[builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1825
|
+
:param pulumi.Input[builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1825
1826
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
1826
|
-
:param pulumi.Input[int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1827
|
+
:param pulumi.Input[builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1827
1828
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
1828
|
-
:param pulumi.Input[str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1829
|
+
:param pulumi.Input[builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1829
1830
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
1830
1831
|
<br>Caution: The path must be readable and writable.
|
|
1831
|
-
:param pulumi.Input[str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1832
|
+
:param pulumi.Input[builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1832
1833
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
1833
|
-
:param pulumi.Input[int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1834
|
+
:param pulumi.Input[builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1834
1835
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
1835
|
-
:param pulumi.Input[str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1836
|
+
:param pulumi.Input[builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1836
1837
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
1837
|
-
:param pulumi.Input[int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1838
|
+
:param pulumi.Input[builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1838
1839
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
1839
|
-
:param pulumi.Input[int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1840
|
-
:param pulumi.Input[int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1841
|
-
:param pulumi.Input[int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1842
|
-
:param pulumi.Input[int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1843
|
-
:param pulumi.Input[int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1840
|
+
:param pulumi.Input[builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1841
|
+
:param pulumi.Input[builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1842
|
+
:param pulumi.Input[builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1843
|
+
:param pulumi.Input[builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1844
|
+
:param pulumi.Input[builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1844
1845
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
1845
1846
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1846
|
-
:param pulumi.Input[int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1847
|
+
:param pulumi.Input[builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1847
1848
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
1848
1849
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
1849
|
-
:param pulumi.Input[int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1850
|
-
:param pulumi.Input[int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1851
|
-
:param pulumi.Input[str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1850
|
+
:param pulumi.Input[builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1851
|
+
:param pulumi.Input[builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1852
|
+
:param pulumi.Input[builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1852
1853
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
1853
1854
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
1854
1855
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
1855
|
-
:param pulumi.Input[int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1856
|
-
:param pulumi.Input[str] name: The name of the index to create.
|
|
1857
|
-
:param pulumi.Input[int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1856
|
+
:param pulumi.Input[builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1857
|
+
:param pulumi.Input[builtins.str] name: The name of the index to create.
|
|
1858
|
+
:param pulumi.Input[builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1858
1859
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
1859
1860
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
1860
1861
|
By default it is turned off (zero).
|
|
1861
|
-
:param pulumi.Input[int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1862
|
+
:param pulumi.Input[builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1862
1863
|
If set to 0, the indexer checks child process status every second.
|
|
1863
1864
|
Highest legal value is 4294967295.
|
|
1864
|
-
:param pulumi.Input[int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1865
|
+
:param pulumi.Input[builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1865
1866
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
1866
|
-
:param pulumi.Input[int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1867
|
-
:param pulumi.Input[int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1868
|
-
:param pulumi.Input[str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1867
|
+
:param pulumi.Input[builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1868
|
+
:param pulumi.Input[builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1869
|
+
:param pulumi.Input[builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1869
1870
|
auto = Use the master index replication configuration value.
|
|
1870
1871
|
0 = Turn off replication for this index.
|
|
1871
|
-
:param pulumi.Input[int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1872
|
-
:param pulumi.Input[int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1872
|
+
:param pulumi.Input[builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1873
|
+
:param pulumi.Input[builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1873
1874
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
1874
|
-
:param pulumi.Input[bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1875
|
-
:param pulumi.Input[str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1875
|
+
:param pulumi.Input[builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1876
|
+
:param pulumi.Input[builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1876
1877
|
Cannot be defined in terms of a volume definition.
|
|
1877
1878
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
1878
|
-
:param pulumi.Input[int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1879
|
-
:param pulumi.Input[str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1879
|
+
:param pulumi.Input[builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1880
|
+
:param pulumi.Input[builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1880
1881
|
If specified, it must be defined in terms of a volume definition.
|
|
1881
|
-
:param pulumi.Input[str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1882
|
+
:param pulumi.Input[builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1882
1883
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
1883
1884
|
"""
|
|
1884
1885
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
@@ -1936,7 +1937,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
1936
1937
|
|
|
1937
1938
|
@property
|
|
1938
1939
|
@pulumi.getter(name="blockSignSize")
|
|
1939
|
-
def block_sign_size(self) -> pulumi.Output[int]:
|
|
1940
|
+
def block_sign_size(self) -> pulumi.Output[builtins.int]:
|
|
1940
1941
|
"""
|
|
1941
1942
|
Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1942
1943
|
"""
|
|
@@ -1944,7 +1945,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
1944
1945
|
|
|
1945
1946
|
@property
|
|
1946
1947
|
@pulumi.getter(name="bucketRebuildMemoryHint")
|
|
1947
|
-
def bucket_rebuild_memory_hint(self) -> pulumi.Output[str]:
|
|
1948
|
+
def bucket_rebuild_memory_hint(self) -> pulumi.Output[builtins.str]:
|
|
1948
1949
|
"""
|
|
1949
1950
|
Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1950
1951
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
@@ -1958,7 +1959,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
1958
1959
|
|
|
1959
1960
|
@property
|
|
1960
1961
|
@pulumi.getter(name="coldPath")
|
|
1961
|
-
def cold_path(self) -> pulumi.Output[str]:
|
|
1962
|
+
def cold_path(self) -> pulumi.Output[builtins.str]:
|
|
1962
1963
|
"""
|
|
1963
1964
|
An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1964
1965
|
"""
|
|
@@ -1966,7 +1967,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
1966
1967
|
|
|
1967
1968
|
@property
|
|
1968
1969
|
@pulumi.getter(name="coldToFrozenDir")
|
|
1969
|
-
def cold_to_frozen_dir(self) -> pulumi.Output[str]:
|
|
1970
|
+
def cold_to_frozen_dir(self) -> pulumi.Output[builtins.str]:
|
|
1970
1971
|
"""
|
|
1971
1972
|
Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1972
1973
|
<br>
|
|
@@ -1981,7 +1982,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
1981
1982
|
|
|
1982
1983
|
@property
|
|
1983
1984
|
@pulumi.getter(name="coldToFrozenScript")
|
|
1984
|
-
def cold_to_frozen_script(self) -> pulumi.Output[str]:
|
|
1985
|
+
def cold_to_frozen_script(self) -> pulumi.Output[builtins.str]:
|
|
1985
1986
|
"""
|
|
1986
1987
|
Path to the archiving script.
|
|
1987
1988
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
@@ -1992,7 +1993,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
1992
1993
|
|
|
1993
1994
|
@property
|
|
1994
1995
|
@pulumi.getter(name="compressRawdata")
|
|
1995
|
-
def compress_rawdata(self) -> pulumi.Output[bool]:
|
|
1996
|
+
def compress_rawdata(self) -> pulumi.Output[builtins.bool]:
|
|
1996
1997
|
"""
|
|
1997
1998
|
This parameter is ignored. The splunkd process always compresses raw data.
|
|
1998
1999
|
"""
|
|
@@ -2000,7 +2001,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2000
2001
|
|
|
2001
2002
|
@property
|
|
2002
2003
|
@pulumi.getter
|
|
2003
|
-
def datatype(self) -> pulumi.Output[str]:
|
|
2004
|
+
def datatype(self) -> pulumi.Output[builtins.str]:
|
|
2004
2005
|
"""
|
|
2005
2006
|
Valid values: (event | metric). Specifies the type of index.
|
|
2006
2007
|
"""
|
|
@@ -2008,7 +2009,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2008
2009
|
|
|
2009
2010
|
@property
|
|
2010
2011
|
@pulumi.getter(name="enableOnlineBucketRepair")
|
|
2011
|
-
def enable_online_bucket_repair(self) -> pulumi.Output[bool]:
|
|
2012
|
+
def enable_online_bucket_repair(self) -> pulumi.Output[builtins.bool]:
|
|
2012
2013
|
"""
|
|
2013
2014
|
Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
2014
2015
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
@@ -2017,7 +2018,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2017
2018
|
|
|
2018
2019
|
@property
|
|
2019
2020
|
@pulumi.getter(name="frozenTimePeriodInSecs")
|
|
2020
|
-
def frozen_time_period_in_secs(self) -> pulumi.Output[int]:
|
|
2021
|
+
def frozen_time_period_in_secs(self) -> pulumi.Output[builtins.int]:
|
|
2021
2022
|
"""
|
|
2022
2023
|
Number of seconds after which indexed data rolls to frozen.
|
|
2023
2024
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
@@ -2026,7 +2027,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2026
2027
|
|
|
2027
2028
|
@property
|
|
2028
2029
|
@pulumi.getter(name="homePath")
|
|
2029
|
-
def home_path(self) -> pulumi.Output[str]:
|
|
2030
|
+
def home_path(self) -> pulumi.Output[builtins.str]:
|
|
2030
2031
|
"""
|
|
2031
2032
|
An absolute path that contains the hot and warm buckets for the index.
|
|
2032
2033
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
@@ -2036,7 +2037,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2036
2037
|
|
|
2037
2038
|
@property
|
|
2038
2039
|
@pulumi.getter(name="maxBloomBackfillBucketAge")
|
|
2039
|
-
def max_bloom_backfill_bucket_age(self) -> pulumi.Output[str]:
|
|
2040
|
+
def max_bloom_backfill_bucket_age(self) -> pulumi.Output[builtins.str]:
|
|
2040
2041
|
"""
|
|
2041
2042
|
Valid values are: Integer[m|s|h|d].
|
|
2042
2043
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
@@ -2045,7 +2046,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2045
2046
|
|
|
2046
2047
|
@property
|
|
2047
2048
|
@pulumi.getter(name="maxConcurrentOptimizes")
|
|
2048
|
-
def max_concurrent_optimizes(self) -> pulumi.Output[int]:
|
|
2049
|
+
def max_concurrent_optimizes(self) -> pulumi.Output[builtins.int]:
|
|
2049
2050
|
"""
|
|
2050
2051
|
The number of concurrent optimize processes that can run against a hot bucket.
|
|
2051
2052
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
@@ -2054,7 +2055,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2054
2055
|
|
|
2055
2056
|
@property
|
|
2056
2057
|
@pulumi.getter(name="maxDataSize")
|
|
2057
|
-
def max_data_size(self) -> pulumi.Output[str]:
|
|
2058
|
+
def max_data_size(self) -> pulumi.Output[builtins.str]:
|
|
2058
2059
|
"""
|
|
2059
2060
|
The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
2060
2061
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
@@ -2063,7 +2064,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2063
2064
|
|
|
2064
2065
|
@property
|
|
2065
2066
|
@pulumi.getter(name="maxHotBuckets")
|
|
2066
|
-
def max_hot_buckets(self) -> pulumi.Output[int]:
|
|
2067
|
+
def max_hot_buckets(self) -> pulumi.Output[builtins.int]:
|
|
2067
2068
|
"""
|
|
2068
2069
|
Maximum hot buckets that can exist per index. Defaults to 3.
|
|
2069
2070
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
@@ -2072,7 +2073,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2072
2073
|
|
|
2073
2074
|
@property
|
|
2074
2075
|
@pulumi.getter(name="maxHotIdleSecs")
|
|
2075
|
-
def max_hot_idle_secs(self) -> pulumi.Output[int]:
|
|
2076
|
+
def max_hot_idle_secs(self) -> pulumi.Output[builtins.int]:
|
|
2076
2077
|
"""
|
|
2077
2078
|
Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
2078
2079
|
"""
|
|
@@ -2080,7 +2081,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2080
2081
|
|
|
2081
2082
|
@property
|
|
2082
2083
|
@pulumi.getter(name="maxHotSpanSecs")
|
|
2083
|
-
def max_hot_span_secs(self) -> pulumi.Output[int]:
|
|
2084
|
+
def max_hot_span_secs(self) -> pulumi.Output[builtins.int]:
|
|
2084
2085
|
"""
|
|
2085
2086
|
Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
2086
2087
|
"""
|
|
@@ -2088,7 +2089,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2088
2089
|
|
|
2089
2090
|
@property
|
|
2090
2091
|
@pulumi.getter(name="maxMemMb")
|
|
2091
|
-
def max_mem_mb(self) -> pulumi.Output[int]:
|
|
2092
|
+
def max_mem_mb(self) -> pulumi.Output[builtins.int]:
|
|
2092
2093
|
"""
|
|
2093
2094
|
The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
2094
2095
|
"""
|
|
@@ -2096,7 +2097,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2096
2097
|
|
|
2097
2098
|
@property
|
|
2098
2099
|
@pulumi.getter(name="maxMetaEntries")
|
|
2099
|
-
def max_meta_entries(self) -> pulumi.Output[int]:
|
|
2100
|
+
def max_meta_entries(self) -> pulumi.Output[builtins.int]:
|
|
2100
2101
|
"""
|
|
2101
2102
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
2102
2103
|
"""
|
|
@@ -2104,7 +2105,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2104
2105
|
|
|
2105
2106
|
@property
|
|
2106
2107
|
@pulumi.getter(name="maxTimeUnreplicatedNoAcks")
|
|
2107
|
-
def max_time_unreplicated_no_acks(self) -> pulumi.Output[int]:
|
|
2108
|
+
def max_time_unreplicated_no_acks(self) -> pulumi.Output[builtins.int]:
|
|
2108
2109
|
"""
|
|
2109
2110
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
2110
2111
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
@@ -2114,7 +2115,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2114
2115
|
|
|
2115
2116
|
@property
|
|
2116
2117
|
@pulumi.getter(name="maxTimeUnreplicatedWithAcks")
|
|
2117
|
-
def max_time_unreplicated_with_acks(self) -> pulumi.Output[int]:
|
|
2118
|
+
def max_time_unreplicated_with_acks(self) -> pulumi.Output[builtins.int]:
|
|
2118
2119
|
"""
|
|
2119
2120
|
Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
2120
2121
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
@@ -2124,7 +2125,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2124
2125
|
|
|
2125
2126
|
@property
|
|
2126
2127
|
@pulumi.getter(name="maxTotalDataSizeMb")
|
|
2127
|
-
def max_total_data_size_mb(self) -> pulumi.Output[int]:
|
|
2128
|
+
def max_total_data_size_mb(self) -> pulumi.Output[builtins.int]:
|
|
2128
2129
|
"""
|
|
2129
2130
|
The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
2130
2131
|
"""
|
|
@@ -2132,7 +2133,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2132
2133
|
|
|
2133
2134
|
@property
|
|
2134
2135
|
@pulumi.getter(name="maxWarmDbCount")
|
|
2135
|
-
def max_warm_db_count(self) -> pulumi.Output[int]:
|
|
2136
|
+
def max_warm_db_count(self) -> pulumi.Output[builtins.int]:
|
|
2136
2137
|
"""
|
|
2137
2138
|
The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
2138
2139
|
"""
|
|
@@ -2140,7 +2141,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2140
2141
|
|
|
2141
2142
|
@property
|
|
2142
2143
|
@pulumi.getter(name="minRawFileSyncSecs")
|
|
2143
|
-
def min_raw_file_sync_secs(self) -> pulumi.Output[str]:
|
|
2144
|
+
def min_raw_file_sync_secs(self) -> pulumi.Output[builtins.str]:
|
|
2144
2145
|
"""
|
|
2145
2146
|
Specify an integer (or "disable") for this parameter.
|
|
2146
2147
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
@@ -2151,7 +2152,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2151
2152
|
|
|
2152
2153
|
@property
|
|
2153
2154
|
@pulumi.getter(name="minStreamGroupQueueSize")
|
|
2154
|
-
def min_stream_group_queue_size(self) -> pulumi.Output[int]:
|
|
2155
|
+
def min_stream_group_queue_size(self) -> pulumi.Output[builtins.int]:
|
|
2155
2156
|
"""
|
|
2156
2157
|
Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
2157
2158
|
"""
|
|
@@ -2159,7 +2160,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2159
2160
|
|
|
2160
2161
|
@property
|
|
2161
2162
|
@pulumi.getter
|
|
2162
|
-
def name(self) -> pulumi.Output[str]:
|
|
2163
|
+
def name(self) -> pulumi.Output[builtins.str]:
|
|
2163
2164
|
"""
|
|
2164
2165
|
The name of the index to create.
|
|
2165
2166
|
"""
|
|
@@ -2167,7 +2168,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2167
2168
|
|
|
2168
2169
|
@property
|
|
2169
2170
|
@pulumi.getter(name="partialServiceMetaPeriod")
|
|
2170
|
-
def partial_service_meta_period(self) -> pulumi.Output[int]:
|
|
2171
|
+
def partial_service_meta_period(self) -> pulumi.Output[builtins.int]:
|
|
2171
2172
|
"""
|
|
2172
2173
|
Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
2173
2174
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
@@ -2178,7 +2179,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2178
2179
|
|
|
2179
2180
|
@property
|
|
2180
2181
|
@pulumi.getter(name="processTrackerServiceInterval")
|
|
2181
|
-
def process_tracker_service_interval(self) -> pulumi.Output[int]:
|
|
2182
|
+
def process_tracker_service_interval(self) -> pulumi.Output[builtins.int]:
|
|
2182
2183
|
"""
|
|
2183
2184
|
Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
2184
2185
|
If set to 0, the indexer checks child process status every second.
|
|
@@ -2188,7 +2189,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2188
2189
|
|
|
2189
2190
|
@property
|
|
2190
2191
|
@pulumi.getter(name="quarantineFutureSecs")
|
|
2191
|
-
def quarantine_future_secs(self) -> pulumi.Output[int]:
|
|
2192
|
+
def quarantine_future_secs(self) -> pulumi.Output[builtins.int]:
|
|
2192
2193
|
"""
|
|
2193
2194
|
Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
2194
2195
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
@@ -2197,7 +2198,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2197
2198
|
|
|
2198
2199
|
@property
|
|
2199
2200
|
@pulumi.getter(name="quarantinePastSecs")
|
|
2200
|
-
def quarantine_past_secs(self) -> pulumi.Output[int]:
|
|
2201
|
+
def quarantine_past_secs(self) -> pulumi.Output[builtins.int]:
|
|
2201
2202
|
"""
|
|
2202
2203
|
Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
2203
2204
|
"""
|
|
@@ -2205,7 +2206,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2205
2206
|
|
|
2206
2207
|
@property
|
|
2207
2208
|
@pulumi.getter(name="rawChunkSizeBytes")
|
|
2208
|
-
def raw_chunk_size_bytes(self) -> pulumi.Output[int]:
|
|
2209
|
+
def raw_chunk_size_bytes(self) -> pulumi.Output[builtins.int]:
|
|
2209
2210
|
"""
|
|
2210
2211
|
Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
2211
2212
|
"""
|
|
@@ -2213,7 +2214,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2213
2214
|
|
|
2214
2215
|
@property
|
|
2215
2216
|
@pulumi.getter(name="repFactor")
|
|
2216
|
-
def rep_factor(self) -> pulumi.Output[str]:
|
|
2217
|
+
def rep_factor(self) -> pulumi.Output[builtins.str]:
|
|
2217
2218
|
"""
|
|
2218
2219
|
Index replication control. This parameter applies to only clustering slaves.
|
|
2219
2220
|
auto = Use the master index replication configuration value.
|
|
@@ -2223,7 +2224,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2223
2224
|
|
|
2224
2225
|
@property
|
|
2225
2226
|
@pulumi.getter(name="rotatePeriodInSecs")
|
|
2226
|
-
def rotate_period_in_secs(self) -> pulumi.Output[int]:
|
|
2227
|
+
def rotate_period_in_secs(self) -> pulumi.Output[builtins.int]:
|
|
2227
2228
|
"""
|
|
2228
2229
|
How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
2229
2230
|
"""
|
|
@@ -2231,7 +2232,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2231
2232
|
|
|
2232
2233
|
@property
|
|
2233
2234
|
@pulumi.getter(name="serviceMetaPeriod")
|
|
2234
|
-
def service_meta_period(self) -> pulumi.Output[int]:
|
|
2235
|
+
def service_meta_period(self) -> pulumi.Output[builtins.int]:
|
|
2235
2236
|
"""
|
|
2236
2237
|
Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
2237
2238
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
@@ -2240,7 +2241,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2240
2241
|
|
|
2241
2242
|
@property
|
|
2242
2243
|
@pulumi.getter(name="syncMeta")
|
|
2243
|
-
def sync_meta(self) -> pulumi.Output[bool]:
|
|
2244
|
+
def sync_meta(self) -> pulumi.Output[builtins.bool]:
|
|
2244
2245
|
"""
|
|
2245
2246
|
When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
2246
2247
|
"""
|
|
@@ -2248,7 +2249,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2248
2249
|
|
|
2249
2250
|
@property
|
|
2250
2251
|
@pulumi.getter(name="thawedPath")
|
|
2251
|
-
def thawed_path(self) -> pulumi.Output[str]:
|
|
2252
|
+
def thawed_path(self) -> pulumi.Output[builtins.str]:
|
|
2252
2253
|
"""
|
|
2253
2254
|
An absolute path that contains the thawed (resurrected) databases for the index.
|
|
2254
2255
|
Cannot be defined in terms of a volume definition.
|
|
@@ -2258,7 +2259,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2258
2259
|
|
|
2259
2260
|
@property
|
|
2260
2261
|
@pulumi.getter(name="throttleCheckPeriod")
|
|
2261
|
-
def throttle_check_period(self) -> pulumi.Output[int]:
|
|
2262
|
+
def throttle_check_period(self) -> pulumi.Output[builtins.int]:
|
|
2262
2263
|
"""
|
|
2263
2264
|
Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
2264
2265
|
"""
|
|
@@ -2266,7 +2267,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2266
2267
|
|
|
2267
2268
|
@property
|
|
2268
2269
|
@pulumi.getter(name="tstatsHomePath")
|
|
2269
|
-
def tstats_home_path(self) -> pulumi.Output[str]:
|
|
2270
|
+
def tstats_home_path(self) -> pulumi.Output[builtins.str]:
|
|
2270
2271
|
"""
|
|
2271
2272
|
Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
2272
2273
|
If specified, it must be defined in terms of a volume definition.
|
|
@@ -2275,7 +2276,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
2275
2276
|
|
|
2276
2277
|
@property
|
|
2277
2278
|
@pulumi.getter(name="warmToColdScript")
|
|
2278
|
-
def warm_to_cold_script(self) -> pulumi.Output[str]:
|
|
2279
|
+
def warm_to_cold_script(self) -> pulumi.Output[builtins.str]:
|
|
2279
2280
|
"""
|
|
2280
2281
|
Path to a script to run when moving data from warm to cold.
|
|
2281
2282
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|