pulumi-splunk 1.3.0a1744699028__py3-none-any.whl → 1.3.0a1762412804__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pulumi-splunk might be problematic. Click here for more details.
- pulumi_splunk/__init__.py +2 -2
- pulumi_splunk/_inputs.py +1275 -1276
- pulumi_splunk/_utilities.py +1 -1
- pulumi_splunk/admin_saml_groups.py +37 -37
- pulumi_splunk/apps_local.py +210 -210
- pulumi_splunk/authentication_users.py +156 -156
- pulumi_splunk/authorization_roles.py +224 -224
- pulumi_splunk/config/__init__.py +2 -2
- pulumi_splunk/config/__init__.pyi +3 -5
- pulumi_splunk/config/vars.py +9 -11
- pulumi_splunk/configs_conf.py +40 -40
- pulumi_splunk/data_ui_views.py +40 -40
- pulumi_splunk/generic_acl.py +23 -23
- pulumi_splunk/global_http_event_collector.py +122 -122
- pulumi_splunk/indexes.py +652 -652
- pulumi_splunk/inputs_http_event_collector.py +159 -159
- pulumi_splunk/inputs_monitor.py +261 -261
- pulumi_splunk/inputs_script.py +159 -159
- pulumi_splunk/inputs_tcp_cooked.py +91 -91
- pulumi_splunk/inputs_tcp_raw.py +176 -176
- pulumi_splunk/inputs_tcp_splunk_tcp_token.py +40 -40
- pulumi_splunk/inputs_tcp_ssl.py +88 -88
- pulumi_splunk/inputs_udp.py +193 -193
- pulumi_splunk/lookup_definition.py +40 -40
- pulumi_splunk/lookup_table_file.py +71 -71
- pulumi_splunk/outputs.py +857 -858
- pulumi_splunk/outputs_tcp_default.py +142 -142
- pulumi_splunk/outputs_tcp_group.py +176 -176
- pulumi_splunk/outputs_tcp_server.py +176 -176
- pulumi_splunk/outputs_tcp_syslog.py +125 -125
- pulumi_splunk/provider.py +94 -79
- pulumi_splunk/pulumi-plugin.json +1 -1
- pulumi_splunk/saved_searches.py +3099 -2887
- pulumi_splunk/sh_indexes_manager.py +74 -74
- {pulumi_splunk-1.3.0a1744699028.dist-info → pulumi_splunk-1.3.0a1762412804.dist-info}/METADATA +2 -2
- pulumi_splunk-1.3.0a1762412804.dist-info/RECORD +39 -0
- {pulumi_splunk-1.3.0a1744699028.dist-info → pulumi_splunk-1.3.0a1762412804.dist-info}/WHEEL +1 -1
- pulumi_splunk-1.3.0a1744699028.dist-info/RECORD +0 -39
- {pulumi_splunk-1.3.0a1744699028.dist-info → pulumi_splunk-1.3.0a1762412804.dist-info}/top_level.txt +0 -0
pulumi_splunk/indexes.py
CHANGED
|
@@ -1,9 +1,8 @@
|
|
|
1
1
|
# coding=utf-8
|
|
2
|
-
# *** WARNING: this file was generated by
|
|
2
|
+
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -23,57 +22,57 @@ __all__ = ['IndexesArgs', 'Indexes']
|
|
|
23
22
|
class IndexesArgs:
|
|
24
23
|
def __init__(__self__, *,
|
|
25
24
|
acl: Optional[pulumi.Input['IndexesAclArgs']] = None,
|
|
26
|
-
block_sign_size: Optional[pulumi.Input[
|
|
27
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[
|
|
28
|
-
cold_path: Optional[pulumi.Input[
|
|
29
|
-
cold_to_frozen_dir: Optional[pulumi.Input[
|
|
30
|
-
cold_to_frozen_script: Optional[pulumi.Input[
|
|
31
|
-
compress_rawdata: Optional[pulumi.Input[
|
|
32
|
-
datatype: Optional[pulumi.Input[
|
|
33
|
-
enable_online_bucket_repair: Optional[pulumi.Input[
|
|
34
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[
|
|
35
|
-
home_path: Optional[pulumi.Input[
|
|
36
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[
|
|
37
|
-
max_concurrent_optimizes: Optional[pulumi.Input[
|
|
38
|
-
max_data_size: Optional[pulumi.Input[
|
|
39
|
-
max_hot_buckets: Optional[pulumi.Input[
|
|
40
|
-
max_hot_idle_secs: Optional[pulumi.Input[
|
|
41
|
-
max_hot_span_secs: Optional[pulumi.Input[
|
|
42
|
-
max_mem_mb: Optional[pulumi.Input[
|
|
43
|
-
max_meta_entries: Optional[pulumi.Input[
|
|
44
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[
|
|
45
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[
|
|
46
|
-
max_total_data_size_mb: Optional[pulumi.Input[
|
|
47
|
-
max_warm_db_count: Optional[pulumi.Input[
|
|
48
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[
|
|
49
|
-
min_stream_group_queue_size: Optional[pulumi.Input[
|
|
50
|
-
name: Optional[pulumi.Input[
|
|
51
|
-
partial_service_meta_period: Optional[pulumi.Input[
|
|
52
|
-
process_tracker_service_interval: Optional[pulumi.Input[
|
|
53
|
-
quarantine_future_secs: Optional[pulumi.Input[
|
|
54
|
-
quarantine_past_secs: Optional[pulumi.Input[
|
|
55
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[
|
|
56
|
-
rep_factor: Optional[pulumi.Input[
|
|
57
|
-
rotate_period_in_secs: Optional[pulumi.Input[
|
|
58
|
-
service_meta_period: Optional[pulumi.Input[
|
|
59
|
-
sync_meta: Optional[pulumi.Input[
|
|
60
|
-
thawed_path: Optional[pulumi.Input[
|
|
61
|
-
throttle_check_period: Optional[pulumi.Input[
|
|
62
|
-
tstats_home_path: Optional[pulumi.Input[
|
|
63
|
-
warm_to_cold_script: Optional[pulumi.Input[
|
|
25
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
26
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
27
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
28
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
31
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
32
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
33
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
34
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
37
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
38
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
39
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
40
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
41
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
42
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
43
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
44
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
45
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
46
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
47
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
48
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
49
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
50
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
51
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
52
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
53
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
54
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
55
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
56
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
57
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
58
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
59
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
60
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
61
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
62
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None):
|
|
64
63
|
"""
|
|
65
64
|
The set of arguments for constructing a Indexes resource.
|
|
66
65
|
:param pulumi.Input['IndexesAclArgs'] acl: The app/user context that is the namespace for the resource
|
|
67
|
-
:param pulumi.Input[
|
|
68
|
-
:param pulumi.Input[
|
|
66
|
+
:param pulumi.Input[_builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
67
|
+
:param pulumi.Input[_builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
69
68
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
70
69
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
71
70
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
72
71
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
73
72
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
74
73
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
75
|
-
:param pulumi.Input[
|
|
76
|
-
:param pulumi.Input[
|
|
74
|
+
:param pulumi.Input[_builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
75
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
77
76
|
<br>
|
|
78
77
|
Bucket freezing policy is as follows:<br>
|
|
79
78
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -81,70 +80,70 @@ class IndexesArgs:
|
|
|
81
80
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
82
81
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
83
82
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
84
|
-
:param pulumi.Input[
|
|
83
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
85
84
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
86
85
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
87
86
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
88
|
-
:param pulumi.Input[
|
|
89
|
-
:param pulumi.Input[
|
|
90
|
-
:param pulumi.Input[
|
|
87
|
+
:param pulumi.Input[_builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
88
|
+
:param pulumi.Input[_builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
89
|
+
:param pulumi.Input[_builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
91
90
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
92
|
-
:param pulumi.Input[
|
|
91
|
+
:param pulumi.Input[_builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
93
92
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
94
|
-
:param pulumi.Input[
|
|
93
|
+
:param pulumi.Input[_builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
95
94
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
96
95
|
<br>Caution: The path must be readable and writable.
|
|
97
|
-
:param pulumi.Input[
|
|
96
|
+
:param pulumi.Input[_builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
98
97
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
99
|
-
:param pulumi.Input[
|
|
98
|
+
:param pulumi.Input[_builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
100
99
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
101
|
-
:param pulumi.Input[
|
|
100
|
+
:param pulumi.Input[_builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
102
101
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
103
|
-
:param pulumi.Input[
|
|
102
|
+
:param pulumi.Input[_builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
104
103
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
105
|
-
:param pulumi.Input[
|
|
106
|
-
:param pulumi.Input[
|
|
107
|
-
:param pulumi.Input[
|
|
108
|
-
:param pulumi.Input[
|
|
109
|
-
:param pulumi.Input[
|
|
104
|
+
:param pulumi.Input[_builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
105
|
+
:param pulumi.Input[_builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
106
|
+
:param pulumi.Input[_builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
107
|
+
:param pulumi.Input[_builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
108
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
110
109
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
111
110
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
112
|
-
:param pulumi.Input[
|
|
111
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
113
112
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
114
113
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
115
|
-
:param pulumi.Input[
|
|
116
|
-
:param pulumi.Input[
|
|
117
|
-
:param pulumi.Input[
|
|
114
|
+
:param pulumi.Input[_builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
115
|
+
:param pulumi.Input[_builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
116
|
+
:param pulumi.Input[_builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
118
117
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
119
118
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
120
119
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
121
|
-
:param pulumi.Input[
|
|
122
|
-
:param pulumi.Input[
|
|
123
|
-
:param pulumi.Input[
|
|
120
|
+
:param pulumi.Input[_builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
121
|
+
:param pulumi.Input[_builtins.str] name: The name of the index to create.
|
|
122
|
+
:param pulumi.Input[_builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
124
123
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
125
124
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
126
125
|
By default it is turned off (zero).
|
|
127
|
-
:param pulumi.Input[
|
|
126
|
+
:param pulumi.Input[_builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
128
127
|
If set to 0, the indexer checks child process status every second.
|
|
129
128
|
Highest legal value is 4294967295.
|
|
130
|
-
:param pulumi.Input[
|
|
129
|
+
:param pulumi.Input[_builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
131
130
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
132
|
-
:param pulumi.Input[
|
|
133
|
-
:param pulumi.Input[
|
|
134
|
-
:param pulumi.Input[
|
|
131
|
+
:param pulumi.Input[_builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
132
|
+
:param pulumi.Input[_builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
133
|
+
:param pulumi.Input[_builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
135
134
|
auto = Use the master index replication configuration value.
|
|
136
135
|
0 = Turn off replication for this index.
|
|
137
|
-
:param pulumi.Input[
|
|
138
|
-
:param pulumi.Input[
|
|
136
|
+
:param pulumi.Input[_builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
137
|
+
:param pulumi.Input[_builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
139
138
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
140
|
-
:param pulumi.Input[
|
|
141
|
-
:param pulumi.Input[
|
|
139
|
+
:param pulumi.Input[_builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
140
|
+
:param pulumi.Input[_builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
142
141
|
Cannot be defined in terms of a volume definition.
|
|
143
142
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
144
|
-
:param pulumi.Input[
|
|
145
|
-
:param pulumi.Input[
|
|
143
|
+
:param pulumi.Input[_builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
144
|
+
:param pulumi.Input[_builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
146
145
|
If specified, it must be defined in terms of a volume definition.
|
|
147
|
-
:param pulumi.Input[
|
|
146
|
+
:param pulumi.Input[_builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
148
147
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
149
148
|
"""
|
|
150
149
|
if acl is not None:
|
|
@@ -226,7 +225,7 @@ class IndexesArgs:
|
|
|
226
225
|
if warm_to_cold_script is not None:
|
|
227
226
|
pulumi.set(__self__, "warm_to_cold_script", warm_to_cold_script)
|
|
228
227
|
|
|
229
|
-
@property
|
|
228
|
+
@_builtins.property
|
|
230
229
|
@pulumi.getter
|
|
231
230
|
def acl(self) -> Optional[pulumi.Input['IndexesAclArgs']]:
|
|
232
231
|
"""
|
|
@@ -238,21 +237,21 @@ class IndexesArgs:
|
|
|
238
237
|
def acl(self, value: Optional[pulumi.Input['IndexesAclArgs']]):
|
|
239
238
|
pulumi.set(self, "acl", value)
|
|
240
239
|
|
|
241
|
-
@property
|
|
240
|
+
@_builtins.property
|
|
242
241
|
@pulumi.getter(name="blockSignSize")
|
|
243
|
-
def block_sign_size(self) -> Optional[pulumi.Input[
|
|
242
|
+
def block_sign_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
244
243
|
"""
|
|
245
244
|
Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
246
245
|
"""
|
|
247
246
|
return pulumi.get(self, "block_sign_size")
|
|
248
247
|
|
|
249
248
|
@block_sign_size.setter
|
|
250
|
-
def block_sign_size(self, value: Optional[pulumi.Input[
|
|
249
|
+
def block_sign_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
251
250
|
pulumi.set(self, "block_sign_size", value)
|
|
252
251
|
|
|
253
|
-
@property
|
|
252
|
+
@_builtins.property
|
|
254
253
|
@pulumi.getter(name="bucketRebuildMemoryHint")
|
|
255
|
-
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[
|
|
254
|
+
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
256
255
|
"""
|
|
257
256
|
Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
258
257
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
@@ -265,24 +264,24 @@ class IndexesArgs:
|
|
|
265
264
|
return pulumi.get(self, "bucket_rebuild_memory_hint")
|
|
266
265
|
|
|
267
266
|
@bucket_rebuild_memory_hint.setter
|
|
268
|
-
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[
|
|
267
|
+
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
269
268
|
pulumi.set(self, "bucket_rebuild_memory_hint", value)
|
|
270
269
|
|
|
271
|
-
@property
|
|
270
|
+
@_builtins.property
|
|
272
271
|
@pulumi.getter(name="coldPath")
|
|
273
|
-
def cold_path(self) -> Optional[pulumi.Input[
|
|
272
|
+
def cold_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
274
273
|
"""
|
|
275
274
|
An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
276
275
|
"""
|
|
277
276
|
return pulumi.get(self, "cold_path")
|
|
278
277
|
|
|
279
278
|
@cold_path.setter
|
|
280
|
-
def cold_path(self, value: Optional[pulumi.Input[
|
|
279
|
+
def cold_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
281
280
|
pulumi.set(self, "cold_path", value)
|
|
282
281
|
|
|
283
|
-
@property
|
|
282
|
+
@_builtins.property
|
|
284
283
|
@pulumi.getter(name="coldToFrozenDir")
|
|
285
|
-
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[
|
|
284
|
+
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
286
285
|
"""
|
|
287
286
|
Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
288
287
|
<br>
|
|
@@ -296,12 +295,12 @@ class IndexesArgs:
|
|
|
296
295
|
return pulumi.get(self, "cold_to_frozen_dir")
|
|
297
296
|
|
|
298
297
|
@cold_to_frozen_dir.setter
|
|
299
|
-
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[
|
|
298
|
+
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
300
299
|
pulumi.set(self, "cold_to_frozen_dir", value)
|
|
301
300
|
|
|
302
|
-
@property
|
|
301
|
+
@_builtins.property
|
|
303
302
|
@pulumi.getter(name="coldToFrozenScript")
|
|
304
|
-
def cold_to_frozen_script(self) -> Optional[pulumi.Input[
|
|
303
|
+
def cold_to_frozen_script(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
305
304
|
"""
|
|
306
305
|
Path to the archiving script.
|
|
307
306
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
@@ -311,36 +310,36 @@ class IndexesArgs:
|
|
|
311
310
|
return pulumi.get(self, "cold_to_frozen_script")
|
|
312
311
|
|
|
313
312
|
@cold_to_frozen_script.setter
|
|
314
|
-
def cold_to_frozen_script(self, value: Optional[pulumi.Input[
|
|
313
|
+
def cold_to_frozen_script(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
315
314
|
pulumi.set(self, "cold_to_frozen_script", value)
|
|
316
315
|
|
|
317
|
-
@property
|
|
316
|
+
@_builtins.property
|
|
318
317
|
@pulumi.getter(name="compressRawdata")
|
|
319
|
-
def compress_rawdata(self) -> Optional[pulumi.Input[
|
|
318
|
+
def compress_rawdata(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
320
319
|
"""
|
|
321
320
|
This parameter is ignored. The splunkd process always compresses raw data.
|
|
322
321
|
"""
|
|
323
322
|
return pulumi.get(self, "compress_rawdata")
|
|
324
323
|
|
|
325
324
|
@compress_rawdata.setter
|
|
326
|
-
def compress_rawdata(self, value: Optional[pulumi.Input[
|
|
325
|
+
def compress_rawdata(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
327
326
|
pulumi.set(self, "compress_rawdata", value)
|
|
328
327
|
|
|
329
|
-
@property
|
|
328
|
+
@_builtins.property
|
|
330
329
|
@pulumi.getter
|
|
331
|
-
def datatype(self) -> Optional[pulumi.Input[
|
|
330
|
+
def datatype(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
332
331
|
"""
|
|
333
332
|
Valid values: (event | metric). Specifies the type of index.
|
|
334
333
|
"""
|
|
335
334
|
return pulumi.get(self, "datatype")
|
|
336
335
|
|
|
337
336
|
@datatype.setter
|
|
338
|
-
def datatype(self, value: Optional[pulumi.Input[
|
|
337
|
+
def datatype(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
339
338
|
pulumi.set(self, "datatype", value)
|
|
340
339
|
|
|
341
|
-
@property
|
|
340
|
+
@_builtins.property
|
|
342
341
|
@pulumi.getter(name="enableOnlineBucketRepair")
|
|
343
|
-
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[
|
|
342
|
+
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
344
343
|
"""
|
|
345
344
|
Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
346
345
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
@@ -348,12 +347,12 @@ class IndexesArgs:
|
|
|
348
347
|
return pulumi.get(self, "enable_online_bucket_repair")
|
|
349
348
|
|
|
350
349
|
@enable_online_bucket_repair.setter
|
|
351
|
-
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[
|
|
350
|
+
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
352
351
|
pulumi.set(self, "enable_online_bucket_repair", value)
|
|
353
352
|
|
|
354
|
-
@property
|
|
353
|
+
@_builtins.property
|
|
355
354
|
@pulumi.getter(name="frozenTimePeriodInSecs")
|
|
356
|
-
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[
|
|
355
|
+
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
357
356
|
"""
|
|
358
357
|
Number of seconds after which indexed data rolls to frozen.
|
|
359
358
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
@@ -361,12 +360,12 @@ class IndexesArgs:
|
|
|
361
360
|
return pulumi.get(self, "frozen_time_period_in_secs")
|
|
362
361
|
|
|
363
362
|
@frozen_time_period_in_secs.setter
|
|
364
|
-
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[
|
|
363
|
+
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
365
364
|
pulumi.set(self, "frozen_time_period_in_secs", value)
|
|
366
365
|
|
|
367
|
-
@property
|
|
366
|
+
@_builtins.property
|
|
368
367
|
@pulumi.getter(name="homePath")
|
|
369
|
-
def home_path(self) -> Optional[pulumi.Input[
|
|
368
|
+
def home_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
370
369
|
"""
|
|
371
370
|
An absolute path that contains the hot and warm buckets for the index.
|
|
372
371
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
@@ -375,12 +374,12 @@ class IndexesArgs:
|
|
|
375
374
|
return pulumi.get(self, "home_path")
|
|
376
375
|
|
|
377
376
|
@home_path.setter
|
|
378
|
-
def home_path(self, value: Optional[pulumi.Input[
|
|
377
|
+
def home_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
379
378
|
pulumi.set(self, "home_path", value)
|
|
380
379
|
|
|
381
|
-
@property
|
|
380
|
+
@_builtins.property
|
|
382
381
|
@pulumi.getter(name="maxBloomBackfillBucketAge")
|
|
383
|
-
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[
|
|
382
|
+
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
384
383
|
"""
|
|
385
384
|
Valid values are: Integer[m|s|h|d].
|
|
386
385
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
@@ -388,12 +387,12 @@ class IndexesArgs:
|
|
|
388
387
|
return pulumi.get(self, "max_bloom_backfill_bucket_age")
|
|
389
388
|
|
|
390
389
|
@max_bloom_backfill_bucket_age.setter
|
|
391
|
-
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[
|
|
390
|
+
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
392
391
|
pulumi.set(self, "max_bloom_backfill_bucket_age", value)
|
|
393
392
|
|
|
394
|
-
@property
|
|
393
|
+
@_builtins.property
|
|
395
394
|
@pulumi.getter(name="maxConcurrentOptimizes")
|
|
396
|
-
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[
|
|
395
|
+
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
397
396
|
"""
|
|
398
397
|
The number of concurrent optimize processes that can run against a hot bucket.
|
|
399
398
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
@@ -401,12 +400,12 @@ class IndexesArgs:
|
|
|
401
400
|
return pulumi.get(self, "max_concurrent_optimizes")
|
|
402
401
|
|
|
403
402
|
@max_concurrent_optimizes.setter
|
|
404
|
-
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[
|
|
403
|
+
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
405
404
|
pulumi.set(self, "max_concurrent_optimizes", value)
|
|
406
405
|
|
|
407
|
-
@property
|
|
406
|
+
@_builtins.property
|
|
408
407
|
@pulumi.getter(name="maxDataSize")
|
|
409
|
-
def max_data_size(self) -> Optional[pulumi.Input[
|
|
408
|
+
def max_data_size(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
410
409
|
"""
|
|
411
410
|
The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
412
411
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
@@ -414,12 +413,12 @@ class IndexesArgs:
|
|
|
414
413
|
return pulumi.get(self, "max_data_size")
|
|
415
414
|
|
|
416
415
|
@max_data_size.setter
|
|
417
|
-
def max_data_size(self, value: Optional[pulumi.Input[
|
|
416
|
+
def max_data_size(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
418
417
|
pulumi.set(self, "max_data_size", value)
|
|
419
418
|
|
|
420
|
-
@property
|
|
419
|
+
@_builtins.property
|
|
421
420
|
@pulumi.getter(name="maxHotBuckets")
|
|
422
|
-
def max_hot_buckets(self) -> Optional[pulumi.Input[
|
|
421
|
+
def max_hot_buckets(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
423
422
|
"""
|
|
424
423
|
Maximum hot buckets that can exist per index. Defaults to 3.
|
|
425
424
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
@@ -427,60 +426,60 @@ class IndexesArgs:
|
|
|
427
426
|
return pulumi.get(self, "max_hot_buckets")
|
|
428
427
|
|
|
429
428
|
@max_hot_buckets.setter
|
|
430
|
-
def max_hot_buckets(self, value: Optional[pulumi.Input[
|
|
429
|
+
def max_hot_buckets(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
431
430
|
pulumi.set(self, "max_hot_buckets", value)
|
|
432
431
|
|
|
433
|
-
@property
|
|
432
|
+
@_builtins.property
|
|
434
433
|
@pulumi.getter(name="maxHotIdleSecs")
|
|
435
|
-
def max_hot_idle_secs(self) -> Optional[pulumi.Input[
|
|
434
|
+
def max_hot_idle_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
436
435
|
"""
|
|
437
436
|
Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
438
437
|
"""
|
|
439
438
|
return pulumi.get(self, "max_hot_idle_secs")
|
|
440
439
|
|
|
441
440
|
@max_hot_idle_secs.setter
|
|
442
|
-
def max_hot_idle_secs(self, value: Optional[pulumi.Input[
|
|
441
|
+
def max_hot_idle_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
443
442
|
pulumi.set(self, "max_hot_idle_secs", value)
|
|
444
443
|
|
|
445
|
-
@property
|
|
444
|
+
@_builtins.property
|
|
446
445
|
@pulumi.getter(name="maxHotSpanSecs")
|
|
447
|
-
def max_hot_span_secs(self) -> Optional[pulumi.Input[
|
|
446
|
+
def max_hot_span_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
448
447
|
"""
|
|
449
448
|
Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
450
449
|
"""
|
|
451
450
|
return pulumi.get(self, "max_hot_span_secs")
|
|
452
451
|
|
|
453
452
|
@max_hot_span_secs.setter
|
|
454
|
-
def max_hot_span_secs(self, value: Optional[pulumi.Input[
|
|
453
|
+
def max_hot_span_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
455
454
|
pulumi.set(self, "max_hot_span_secs", value)
|
|
456
455
|
|
|
457
|
-
@property
|
|
456
|
+
@_builtins.property
|
|
458
457
|
@pulumi.getter(name="maxMemMb")
|
|
459
|
-
def max_mem_mb(self) -> Optional[pulumi.Input[
|
|
458
|
+
def max_mem_mb(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
460
459
|
"""
|
|
461
460
|
The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
462
461
|
"""
|
|
463
462
|
return pulumi.get(self, "max_mem_mb")
|
|
464
463
|
|
|
465
464
|
@max_mem_mb.setter
|
|
466
|
-
def max_mem_mb(self, value: Optional[pulumi.Input[
|
|
465
|
+
def max_mem_mb(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
467
466
|
pulumi.set(self, "max_mem_mb", value)
|
|
468
467
|
|
|
469
|
-
@property
|
|
468
|
+
@_builtins.property
|
|
470
469
|
@pulumi.getter(name="maxMetaEntries")
|
|
471
|
-
def max_meta_entries(self) -> Optional[pulumi.Input[
|
|
470
|
+
def max_meta_entries(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
472
471
|
"""
|
|
473
472
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
474
473
|
"""
|
|
475
474
|
return pulumi.get(self, "max_meta_entries")
|
|
476
475
|
|
|
477
476
|
@max_meta_entries.setter
|
|
478
|
-
def max_meta_entries(self, value: Optional[pulumi.Input[
|
|
477
|
+
def max_meta_entries(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
479
478
|
pulumi.set(self, "max_meta_entries", value)
|
|
480
479
|
|
|
481
|
-
@property
|
|
480
|
+
@_builtins.property
|
|
482
481
|
@pulumi.getter(name="maxTimeUnreplicatedNoAcks")
|
|
483
|
-
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[
|
|
482
|
+
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
484
483
|
"""
|
|
485
484
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
486
485
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
@@ -489,12 +488,12 @@ class IndexesArgs:
|
|
|
489
488
|
return pulumi.get(self, "max_time_unreplicated_no_acks")
|
|
490
489
|
|
|
491
490
|
@max_time_unreplicated_no_acks.setter
|
|
492
|
-
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[
|
|
491
|
+
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
493
492
|
pulumi.set(self, "max_time_unreplicated_no_acks", value)
|
|
494
493
|
|
|
495
|
-
@property
|
|
494
|
+
@_builtins.property
|
|
496
495
|
@pulumi.getter(name="maxTimeUnreplicatedWithAcks")
|
|
497
|
-
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[
|
|
496
|
+
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
498
497
|
"""
|
|
499
498
|
Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
500
499
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
@@ -503,36 +502,36 @@ class IndexesArgs:
|
|
|
503
502
|
return pulumi.get(self, "max_time_unreplicated_with_acks")
|
|
504
503
|
|
|
505
504
|
@max_time_unreplicated_with_acks.setter
|
|
506
|
-
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[
|
|
505
|
+
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
507
506
|
pulumi.set(self, "max_time_unreplicated_with_acks", value)
|
|
508
507
|
|
|
509
|
-
@property
|
|
508
|
+
@_builtins.property
|
|
510
509
|
@pulumi.getter(name="maxTotalDataSizeMb")
|
|
511
|
-
def max_total_data_size_mb(self) -> Optional[pulumi.Input[
|
|
510
|
+
def max_total_data_size_mb(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
512
511
|
"""
|
|
513
512
|
The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
514
513
|
"""
|
|
515
514
|
return pulumi.get(self, "max_total_data_size_mb")
|
|
516
515
|
|
|
517
516
|
@max_total_data_size_mb.setter
|
|
518
|
-
def max_total_data_size_mb(self, value: Optional[pulumi.Input[
|
|
517
|
+
def max_total_data_size_mb(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
519
518
|
pulumi.set(self, "max_total_data_size_mb", value)
|
|
520
519
|
|
|
521
|
-
@property
|
|
520
|
+
@_builtins.property
|
|
522
521
|
@pulumi.getter(name="maxWarmDbCount")
|
|
523
|
-
def max_warm_db_count(self) -> Optional[pulumi.Input[
|
|
522
|
+
def max_warm_db_count(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
524
523
|
"""
|
|
525
524
|
The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
526
525
|
"""
|
|
527
526
|
return pulumi.get(self, "max_warm_db_count")
|
|
528
527
|
|
|
529
528
|
@max_warm_db_count.setter
|
|
530
|
-
def max_warm_db_count(self, value: Optional[pulumi.Input[
|
|
529
|
+
def max_warm_db_count(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
531
530
|
pulumi.set(self, "max_warm_db_count", value)
|
|
532
531
|
|
|
533
|
-
@property
|
|
532
|
+
@_builtins.property
|
|
534
533
|
@pulumi.getter(name="minRawFileSyncSecs")
|
|
535
|
-
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[
|
|
534
|
+
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
536
535
|
"""
|
|
537
536
|
Specify an integer (or "disable") for this parameter.
|
|
538
537
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
@@ -542,36 +541,36 @@ class IndexesArgs:
|
|
|
542
541
|
return pulumi.get(self, "min_raw_file_sync_secs")
|
|
543
542
|
|
|
544
543
|
@min_raw_file_sync_secs.setter
|
|
545
|
-
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[
|
|
544
|
+
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
546
545
|
pulumi.set(self, "min_raw_file_sync_secs", value)
|
|
547
546
|
|
|
548
|
-
@property
|
|
547
|
+
@_builtins.property
|
|
549
548
|
@pulumi.getter(name="minStreamGroupQueueSize")
|
|
550
|
-
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[
|
|
549
|
+
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
551
550
|
"""
|
|
552
551
|
Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
553
552
|
"""
|
|
554
553
|
return pulumi.get(self, "min_stream_group_queue_size")
|
|
555
554
|
|
|
556
555
|
@min_stream_group_queue_size.setter
|
|
557
|
-
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[
|
|
556
|
+
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
558
557
|
pulumi.set(self, "min_stream_group_queue_size", value)
|
|
559
558
|
|
|
560
|
-
@property
|
|
559
|
+
@_builtins.property
|
|
561
560
|
@pulumi.getter
|
|
562
|
-
def name(self) -> Optional[pulumi.Input[
|
|
561
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
563
562
|
"""
|
|
564
563
|
The name of the index to create.
|
|
565
564
|
"""
|
|
566
565
|
return pulumi.get(self, "name")
|
|
567
566
|
|
|
568
567
|
@name.setter
|
|
569
|
-
def name(self, value: Optional[pulumi.Input[
|
|
568
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
570
569
|
pulumi.set(self, "name", value)
|
|
571
570
|
|
|
572
|
-
@property
|
|
571
|
+
@_builtins.property
|
|
573
572
|
@pulumi.getter(name="partialServiceMetaPeriod")
|
|
574
|
-
def partial_service_meta_period(self) -> Optional[pulumi.Input[
|
|
573
|
+
def partial_service_meta_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
575
574
|
"""
|
|
576
575
|
Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
577
576
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
@@ -581,12 +580,12 @@ class IndexesArgs:
|
|
|
581
580
|
return pulumi.get(self, "partial_service_meta_period")
|
|
582
581
|
|
|
583
582
|
@partial_service_meta_period.setter
|
|
584
|
-
def partial_service_meta_period(self, value: Optional[pulumi.Input[
|
|
583
|
+
def partial_service_meta_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
585
584
|
pulumi.set(self, "partial_service_meta_period", value)
|
|
586
585
|
|
|
587
|
-
@property
|
|
586
|
+
@_builtins.property
|
|
588
587
|
@pulumi.getter(name="processTrackerServiceInterval")
|
|
589
|
-
def process_tracker_service_interval(self) -> Optional[pulumi.Input[
|
|
588
|
+
def process_tracker_service_interval(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
590
589
|
"""
|
|
591
590
|
Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
592
591
|
If set to 0, the indexer checks child process status every second.
|
|
@@ -595,12 +594,12 @@ class IndexesArgs:
|
|
|
595
594
|
return pulumi.get(self, "process_tracker_service_interval")
|
|
596
595
|
|
|
597
596
|
@process_tracker_service_interval.setter
|
|
598
|
-
def process_tracker_service_interval(self, value: Optional[pulumi.Input[
|
|
597
|
+
def process_tracker_service_interval(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
599
598
|
pulumi.set(self, "process_tracker_service_interval", value)
|
|
600
599
|
|
|
601
|
-
@property
|
|
600
|
+
@_builtins.property
|
|
602
601
|
@pulumi.getter(name="quarantineFutureSecs")
|
|
603
|
-
def quarantine_future_secs(self) -> Optional[pulumi.Input[
|
|
602
|
+
def quarantine_future_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
604
603
|
"""
|
|
605
604
|
Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
606
605
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
@@ -608,36 +607,36 @@ class IndexesArgs:
|
|
|
608
607
|
return pulumi.get(self, "quarantine_future_secs")
|
|
609
608
|
|
|
610
609
|
@quarantine_future_secs.setter
|
|
611
|
-
def quarantine_future_secs(self, value: Optional[pulumi.Input[
|
|
610
|
+
def quarantine_future_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
612
611
|
pulumi.set(self, "quarantine_future_secs", value)
|
|
613
612
|
|
|
614
|
-
@property
|
|
613
|
+
@_builtins.property
|
|
615
614
|
@pulumi.getter(name="quarantinePastSecs")
|
|
616
|
-
def quarantine_past_secs(self) -> Optional[pulumi.Input[
|
|
615
|
+
def quarantine_past_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
617
616
|
"""
|
|
618
617
|
Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
619
618
|
"""
|
|
620
619
|
return pulumi.get(self, "quarantine_past_secs")
|
|
621
620
|
|
|
622
621
|
@quarantine_past_secs.setter
|
|
623
|
-
def quarantine_past_secs(self, value: Optional[pulumi.Input[
|
|
622
|
+
def quarantine_past_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
624
623
|
pulumi.set(self, "quarantine_past_secs", value)
|
|
625
624
|
|
|
626
|
-
@property
|
|
625
|
+
@_builtins.property
|
|
627
626
|
@pulumi.getter(name="rawChunkSizeBytes")
|
|
628
|
-
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[
|
|
627
|
+
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
629
628
|
"""
|
|
630
629
|
Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
631
630
|
"""
|
|
632
631
|
return pulumi.get(self, "raw_chunk_size_bytes")
|
|
633
632
|
|
|
634
633
|
@raw_chunk_size_bytes.setter
|
|
635
|
-
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[
|
|
634
|
+
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
636
635
|
pulumi.set(self, "raw_chunk_size_bytes", value)
|
|
637
636
|
|
|
638
|
-
@property
|
|
637
|
+
@_builtins.property
|
|
639
638
|
@pulumi.getter(name="repFactor")
|
|
640
|
-
def rep_factor(self) -> Optional[pulumi.Input[
|
|
639
|
+
def rep_factor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
641
640
|
"""
|
|
642
641
|
Index replication control. This parameter applies to only clustering slaves.
|
|
643
642
|
auto = Use the master index replication configuration value.
|
|
@@ -646,24 +645,24 @@ class IndexesArgs:
|
|
|
646
645
|
return pulumi.get(self, "rep_factor")
|
|
647
646
|
|
|
648
647
|
@rep_factor.setter
|
|
649
|
-
def rep_factor(self, value: Optional[pulumi.Input[
|
|
648
|
+
def rep_factor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
650
649
|
pulumi.set(self, "rep_factor", value)
|
|
651
650
|
|
|
652
|
-
@property
|
|
651
|
+
@_builtins.property
|
|
653
652
|
@pulumi.getter(name="rotatePeriodInSecs")
|
|
654
|
-
def rotate_period_in_secs(self) -> Optional[pulumi.Input[
|
|
653
|
+
def rotate_period_in_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
655
654
|
"""
|
|
656
655
|
How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
657
656
|
"""
|
|
658
657
|
return pulumi.get(self, "rotate_period_in_secs")
|
|
659
658
|
|
|
660
659
|
@rotate_period_in_secs.setter
|
|
661
|
-
def rotate_period_in_secs(self, value: Optional[pulumi.Input[
|
|
660
|
+
def rotate_period_in_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
662
661
|
pulumi.set(self, "rotate_period_in_secs", value)
|
|
663
662
|
|
|
664
|
-
@property
|
|
663
|
+
@_builtins.property
|
|
665
664
|
@pulumi.getter(name="serviceMetaPeriod")
|
|
666
|
-
def service_meta_period(self) -> Optional[pulumi.Input[
|
|
665
|
+
def service_meta_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
667
666
|
"""
|
|
668
667
|
Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
669
668
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
@@ -671,24 +670,24 @@ class IndexesArgs:
|
|
|
671
670
|
return pulumi.get(self, "service_meta_period")
|
|
672
671
|
|
|
673
672
|
@service_meta_period.setter
|
|
674
|
-
def service_meta_period(self, value: Optional[pulumi.Input[
|
|
673
|
+
def service_meta_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
675
674
|
pulumi.set(self, "service_meta_period", value)
|
|
676
675
|
|
|
677
|
-
@property
|
|
676
|
+
@_builtins.property
|
|
678
677
|
@pulumi.getter(name="syncMeta")
|
|
679
|
-
def sync_meta(self) -> Optional[pulumi.Input[
|
|
678
|
+
def sync_meta(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
680
679
|
"""
|
|
681
680
|
When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
682
681
|
"""
|
|
683
682
|
return pulumi.get(self, "sync_meta")
|
|
684
683
|
|
|
685
684
|
@sync_meta.setter
|
|
686
|
-
def sync_meta(self, value: Optional[pulumi.Input[
|
|
685
|
+
def sync_meta(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
687
686
|
pulumi.set(self, "sync_meta", value)
|
|
688
687
|
|
|
689
|
-
@property
|
|
688
|
+
@_builtins.property
|
|
690
689
|
@pulumi.getter(name="thawedPath")
|
|
691
|
-
def thawed_path(self) -> Optional[pulumi.Input[
|
|
690
|
+
def thawed_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
692
691
|
"""
|
|
693
692
|
An absolute path that contains the thawed (resurrected) databases for the index.
|
|
694
693
|
Cannot be defined in terms of a volume definition.
|
|
@@ -697,24 +696,24 @@ class IndexesArgs:
|
|
|
697
696
|
return pulumi.get(self, "thawed_path")
|
|
698
697
|
|
|
699
698
|
@thawed_path.setter
|
|
700
|
-
def thawed_path(self, value: Optional[pulumi.Input[
|
|
699
|
+
def thawed_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
701
700
|
pulumi.set(self, "thawed_path", value)
|
|
702
701
|
|
|
703
|
-
@property
|
|
702
|
+
@_builtins.property
|
|
704
703
|
@pulumi.getter(name="throttleCheckPeriod")
|
|
705
|
-
def throttle_check_period(self) -> Optional[pulumi.Input[
|
|
704
|
+
def throttle_check_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
706
705
|
"""
|
|
707
706
|
Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
708
707
|
"""
|
|
709
708
|
return pulumi.get(self, "throttle_check_period")
|
|
710
709
|
|
|
711
710
|
@throttle_check_period.setter
|
|
712
|
-
def throttle_check_period(self, value: Optional[pulumi.Input[
|
|
711
|
+
def throttle_check_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
713
712
|
pulumi.set(self, "throttle_check_period", value)
|
|
714
713
|
|
|
715
|
-
@property
|
|
714
|
+
@_builtins.property
|
|
716
715
|
@pulumi.getter(name="tstatsHomePath")
|
|
717
|
-
def tstats_home_path(self) -> Optional[pulumi.Input[
|
|
716
|
+
def tstats_home_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
718
717
|
"""
|
|
719
718
|
Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
720
719
|
If specified, it must be defined in terms of a volume definition.
|
|
@@ -722,12 +721,12 @@ class IndexesArgs:
|
|
|
722
721
|
return pulumi.get(self, "tstats_home_path")
|
|
723
722
|
|
|
724
723
|
@tstats_home_path.setter
|
|
725
|
-
def tstats_home_path(self, value: Optional[pulumi.Input[
|
|
724
|
+
def tstats_home_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
726
725
|
pulumi.set(self, "tstats_home_path", value)
|
|
727
726
|
|
|
728
|
-
@property
|
|
727
|
+
@_builtins.property
|
|
729
728
|
@pulumi.getter(name="warmToColdScript")
|
|
730
|
-
def warm_to_cold_script(self) -> Optional[pulumi.Input[
|
|
729
|
+
def warm_to_cold_script(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
731
730
|
"""
|
|
732
731
|
Path to a script to run when moving data from warm to cold.
|
|
733
732
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
@@ -735,7 +734,7 @@ class IndexesArgs:
|
|
|
735
734
|
return pulumi.get(self, "warm_to_cold_script")
|
|
736
735
|
|
|
737
736
|
@warm_to_cold_script.setter
|
|
738
|
-
def warm_to_cold_script(self, value: Optional[pulumi.Input[
|
|
737
|
+
def warm_to_cold_script(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
739
738
|
pulumi.set(self, "warm_to_cold_script", value)
|
|
740
739
|
|
|
741
740
|
|
|
@@ -743,57 +742,57 @@ class IndexesArgs:
|
|
|
743
742
|
class _IndexesState:
|
|
744
743
|
def __init__(__self__, *,
|
|
745
744
|
acl: Optional[pulumi.Input['IndexesAclArgs']] = None,
|
|
746
|
-
block_sign_size: Optional[pulumi.Input[
|
|
747
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[
|
|
748
|
-
cold_path: Optional[pulumi.Input[
|
|
749
|
-
cold_to_frozen_dir: Optional[pulumi.Input[
|
|
750
|
-
cold_to_frozen_script: Optional[pulumi.Input[
|
|
751
|
-
compress_rawdata: Optional[pulumi.Input[
|
|
752
|
-
datatype: Optional[pulumi.Input[
|
|
753
|
-
enable_online_bucket_repair: Optional[pulumi.Input[
|
|
754
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[
|
|
755
|
-
home_path: Optional[pulumi.Input[
|
|
756
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[
|
|
757
|
-
max_concurrent_optimizes: Optional[pulumi.Input[
|
|
758
|
-
max_data_size: Optional[pulumi.Input[
|
|
759
|
-
max_hot_buckets: Optional[pulumi.Input[
|
|
760
|
-
max_hot_idle_secs: Optional[pulumi.Input[
|
|
761
|
-
max_hot_span_secs: Optional[pulumi.Input[
|
|
762
|
-
max_mem_mb: Optional[pulumi.Input[
|
|
763
|
-
max_meta_entries: Optional[pulumi.Input[
|
|
764
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[
|
|
765
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[
|
|
766
|
-
max_total_data_size_mb: Optional[pulumi.Input[
|
|
767
|
-
max_warm_db_count: Optional[pulumi.Input[
|
|
768
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[
|
|
769
|
-
min_stream_group_queue_size: Optional[pulumi.Input[
|
|
770
|
-
name: Optional[pulumi.Input[
|
|
771
|
-
partial_service_meta_period: Optional[pulumi.Input[
|
|
772
|
-
process_tracker_service_interval: Optional[pulumi.Input[
|
|
773
|
-
quarantine_future_secs: Optional[pulumi.Input[
|
|
774
|
-
quarantine_past_secs: Optional[pulumi.Input[
|
|
775
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[
|
|
776
|
-
rep_factor: Optional[pulumi.Input[
|
|
777
|
-
rotate_period_in_secs: Optional[pulumi.Input[
|
|
778
|
-
service_meta_period: Optional[pulumi.Input[
|
|
779
|
-
sync_meta: Optional[pulumi.Input[
|
|
780
|
-
thawed_path: Optional[pulumi.Input[
|
|
781
|
-
throttle_check_period: Optional[pulumi.Input[
|
|
782
|
-
tstats_home_path: Optional[pulumi.Input[
|
|
783
|
-
warm_to_cold_script: Optional[pulumi.Input[
|
|
745
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
746
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
747
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
748
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
749
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
750
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
751
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
752
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
753
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
754
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
755
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
756
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
757
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
758
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
759
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
760
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
761
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
762
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
763
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
764
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
765
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
766
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
767
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
768
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
769
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
770
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
771
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
772
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
773
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
774
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
775
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
776
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
777
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
778
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
779
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
780
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
781
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
782
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None):
|
|
784
783
|
"""
|
|
785
784
|
Input properties used for looking up and filtering Indexes resources.
|
|
786
785
|
:param pulumi.Input['IndexesAclArgs'] acl: The app/user context that is the namespace for the resource
|
|
787
|
-
:param pulumi.Input[
|
|
788
|
-
:param pulumi.Input[
|
|
786
|
+
:param pulumi.Input[_builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
787
|
+
:param pulumi.Input[_builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
789
788
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
790
789
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
791
790
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
792
791
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
793
792
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
794
793
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
795
|
-
:param pulumi.Input[
|
|
796
|
-
:param pulumi.Input[
|
|
794
|
+
:param pulumi.Input[_builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
795
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
797
796
|
<br>
|
|
798
797
|
Bucket freezing policy is as follows:<br>
|
|
799
798
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -801,70 +800,70 @@ class _IndexesState:
|
|
|
801
800
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
802
801
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
803
802
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
804
|
-
:param pulumi.Input[
|
|
803
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
805
804
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
806
805
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
807
806
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
808
|
-
:param pulumi.Input[
|
|
809
|
-
:param pulumi.Input[
|
|
810
|
-
:param pulumi.Input[
|
|
807
|
+
:param pulumi.Input[_builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
808
|
+
:param pulumi.Input[_builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
809
|
+
:param pulumi.Input[_builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
811
810
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
812
|
-
:param pulumi.Input[
|
|
811
|
+
:param pulumi.Input[_builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
813
812
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
814
|
-
:param pulumi.Input[
|
|
813
|
+
:param pulumi.Input[_builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
815
814
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
816
815
|
<br>Caution: The path must be readable and writable.
|
|
817
|
-
:param pulumi.Input[
|
|
816
|
+
:param pulumi.Input[_builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
818
817
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
819
|
-
:param pulumi.Input[
|
|
818
|
+
:param pulumi.Input[_builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
820
819
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
821
|
-
:param pulumi.Input[
|
|
820
|
+
:param pulumi.Input[_builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
822
821
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
823
|
-
:param pulumi.Input[
|
|
822
|
+
:param pulumi.Input[_builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
824
823
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
825
|
-
:param pulumi.Input[
|
|
826
|
-
:param pulumi.Input[
|
|
827
|
-
:param pulumi.Input[
|
|
828
|
-
:param pulumi.Input[
|
|
829
|
-
:param pulumi.Input[
|
|
824
|
+
:param pulumi.Input[_builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
825
|
+
:param pulumi.Input[_builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
826
|
+
:param pulumi.Input[_builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
827
|
+
:param pulumi.Input[_builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
828
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
830
829
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
831
830
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
832
|
-
:param pulumi.Input[
|
|
831
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
833
832
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
834
833
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
835
|
-
:param pulumi.Input[
|
|
836
|
-
:param pulumi.Input[
|
|
837
|
-
:param pulumi.Input[
|
|
834
|
+
:param pulumi.Input[_builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
835
|
+
:param pulumi.Input[_builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
836
|
+
:param pulumi.Input[_builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
838
837
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
839
838
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
840
839
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
841
|
-
:param pulumi.Input[
|
|
842
|
-
:param pulumi.Input[
|
|
843
|
-
:param pulumi.Input[
|
|
840
|
+
:param pulumi.Input[_builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
841
|
+
:param pulumi.Input[_builtins.str] name: The name of the index to create.
|
|
842
|
+
:param pulumi.Input[_builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
844
843
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
845
844
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
846
845
|
By default it is turned off (zero).
|
|
847
|
-
:param pulumi.Input[
|
|
846
|
+
:param pulumi.Input[_builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
848
847
|
If set to 0, the indexer checks child process status every second.
|
|
849
848
|
Highest legal value is 4294967295.
|
|
850
|
-
:param pulumi.Input[
|
|
849
|
+
:param pulumi.Input[_builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
851
850
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
852
|
-
:param pulumi.Input[
|
|
853
|
-
:param pulumi.Input[
|
|
854
|
-
:param pulumi.Input[
|
|
851
|
+
:param pulumi.Input[_builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
852
|
+
:param pulumi.Input[_builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
853
|
+
:param pulumi.Input[_builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
855
854
|
auto = Use the master index replication configuration value.
|
|
856
855
|
0 = Turn off replication for this index.
|
|
857
|
-
:param pulumi.Input[
|
|
858
|
-
:param pulumi.Input[
|
|
856
|
+
:param pulumi.Input[_builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
857
|
+
:param pulumi.Input[_builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
859
858
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
860
|
-
:param pulumi.Input[
|
|
861
|
-
:param pulumi.Input[
|
|
859
|
+
:param pulumi.Input[_builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
860
|
+
:param pulumi.Input[_builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
862
861
|
Cannot be defined in terms of a volume definition.
|
|
863
862
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
864
|
-
:param pulumi.Input[
|
|
865
|
-
:param pulumi.Input[
|
|
863
|
+
:param pulumi.Input[_builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
864
|
+
:param pulumi.Input[_builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
866
865
|
If specified, it must be defined in terms of a volume definition.
|
|
867
|
-
:param pulumi.Input[
|
|
866
|
+
:param pulumi.Input[_builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
868
867
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
869
868
|
"""
|
|
870
869
|
if acl is not None:
|
|
@@ -946,7 +945,7 @@ class _IndexesState:
|
|
|
946
945
|
if warm_to_cold_script is not None:
|
|
947
946
|
pulumi.set(__self__, "warm_to_cold_script", warm_to_cold_script)
|
|
948
947
|
|
|
949
|
-
@property
|
|
948
|
+
@_builtins.property
|
|
950
949
|
@pulumi.getter
|
|
951
950
|
def acl(self) -> Optional[pulumi.Input['IndexesAclArgs']]:
|
|
952
951
|
"""
|
|
@@ -958,21 +957,21 @@ class _IndexesState:
|
|
|
958
957
|
def acl(self, value: Optional[pulumi.Input['IndexesAclArgs']]):
|
|
959
958
|
pulumi.set(self, "acl", value)
|
|
960
959
|
|
|
961
|
-
@property
|
|
960
|
+
@_builtins.property
|
|
962
961
|
@pulumi.getter(name="blockSignSize")
|
|
963
|
-
def block_sign_size(self) -> Optional[pulumi.Input[
|
|
962
|
+
def block_sign_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
964
963
|
"""
|
|
965
964
|
Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
966
965
|
"""
|
|
967
966
|
return pulumi.get(self, "block_sign_size")
|
|
968
967
|
|
|
969
968
|
@block_sign_size.setter
|
|
970
|
-
def block_sign_size(self, value: Optional[pulumi.Input[
|
|
969
|
+
def block_sign_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
971
970
|
pulumi.set(self, "block_sign_size", value)
|
|
972
971
|
|
|
973
|
-
@property
|
|
972
|
+
@_builtins.property
|
|
974
973
|
@pulumi.getter(name="bucketRebuildMemoryHint")
|
|
975
|
-
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[
|
|
974
|
+
def bucket_rebuild_memory_hint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
976
975
|
"""
|
|
977
976
|
Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
978
977
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
@@ -985,24 +984,24 @@ class _IndexesState:
|
|
|
985
984
|
return pulumi.get(self, "bucket_rebuild_memory_hint")
|
|
986
985
|
|
|
987
986
|
@bucket_rebuild_memory_hint.setter
|
|
988
|
-
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[
|
|
987
|
+
def bucket_rebuild_memory_hint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
989
988
|
pulumi.set(self, "bucket_rebuild_memory_hint", value)
|
|
990
989
|
|
|
991
|
-
@property
|
|
990
|
+
@_builtins.property
|
|
992
991
|
@pulumi.getter(name="coldPath")
|
|
993
|
-
def cold_path(self) -> Optional[pulumi.Input[
|
|
992
|
+
def cold_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
994
993
|
"""
|
|
995
994
|
An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
996
995
|
"""
|
|
997
996
|
return pulumi.get(self, "cold_path")
|
|
998
997
|
|
|
999
998
|
@cold_path.setter
|
|
1000
|
-
def cold_path(self, value: Optional[pulumi.Input[
|
|
999
|
+
def cold_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1001
1000
|
pulumi.set(self, "cold_path", value)
|
|
1002
1001
|
|
|
1003
|
-
@property
|
|
1002
|
+
@_builtins.property
|
|
1004
1003
|
@pulumi.getter(name="coldToFrozenDir")
|
|
1005
|
-
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[
|
|
1004
|
+
def cold_to_frozen_dir(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1006
1005
|
"""
|
|
1007
1006
|
Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1008
1007
|
<br>
|
|
@@ -1016,12 +1015,12 @@ class _IndexesState:
|
|
|
1016
1015
|
return pulumi.get(self, "cold_to_frozen_dir")
|
|
1017
1016
|
|
|
1018
1017
|
@cold_to_frozen_dir.setter
|
|
1019
|
-
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[
|
|
1018
|
+
def cold_to_frozen_dir(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1020
1019
|
pulumi.set(self, "cold_to_frozen_dir", value)
|
|
1021
1020
|
|
|
1022
|
-
@property
|
|
1021
|
+
@_builtins.property
|
|
1023
1022
|
@pulumi.getter(name="coldToFrozenScript")
|
|
1024
|
-
def cold_to_frozen_script(self) -> Optional[pulumi.Input[
|
|
1023
|
+
def cold_to_frozen_script(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1025
1024
|
"""
|
|
1026
1025
|
Path to the archiving script.
|
|
1027
1026
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
@@ -1031,36 +1030,36 @@ class _IndexesState:
|
|
|
1031
1030
|
return pulumi.get(self, "cold_to_frozen_script")
|
|
1032
1031
|
|
|
1033
1032
|
@cold_to_frozen_script.setter
|
|
1034
|
-
def cold_to_frozen_script(self, value: Optional[pulumi.Input[
|
|
1033
|
+
def cold_to_frozen_script(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1035
1034
|
pulumi.set(self, "cold_to_frozen_script", value)
|
|
1036
1035
|
|
|
1037
|
-
@property
|
|
1036
|
+
@_builtins.property
|
|
1038
1037
|
@pulumi.getter(name="compressRawdata")
|
|
1039
|
-
def compress_rawdata(self) -> Optional[pulumi.Input[
|
|
1038
|
+
def compress_rawdata(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1040
1039
|
"""
|
|
1041
1040
|
This parameter is ignored. The splunkd process always compresses raw data.
|
|
1042
1041
|
"""
|
|
1043
1042
|
return pulumi.get(self, "compress_rawdata")
|
|
1044
1043
|
|
|
1045
1044
|
@compress_rawdata.setter
|
|
1046
|
-
def compress_rawdata(self, value: Optional[pulumi.Input[
|
|
1045
|
+
def compress_rawdata(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1047
1046
|
pulumi.set(self, "compress_rawdata", value)
|
|
1048
1047
|
|
|
1049
|
-
@property
|
|
1048
|
+
@_builtins.property
|
|
1050
1049
|
@pulumi.getter
|
|
1051
|
-
def datatype(self) -> Optional[pulumi.Input[
|
|
1050
|
+
def datatype(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1052
1051
|
"""
|
|
1053
1052
|
Valid values: (event | metric). Specifies the type of index.
|
|
1054
1053
|
"""
|
|
1055
1054
|
return pulumi.get(self, "datatype")
|
|
1056
1055
|
|
|
1057
1056
|
@datatype.setter
|
|
1058
|
-
def datatype(self, value: Optional[pulumi.Input[
|
|
1057
|
+
def datatype(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1059
1058
|
pulumi.set(self, "datatype", value)
|
|
1060
1059
|
|
|
1061
|
-
@property
|
|
1060
|
+
@_builtins.property
|
|
1062
1061
|
@pulumi.getter(name="enableOnlineBucketRepair")
|
|
1063
|
-
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[
|
|
1062
|
+
def enable_online_bucket_repair(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1064
1063
|
"""
|
|
1065
1064
|
Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1066
1065
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
@@ -1068,12 +1067,12 @@ class _IndexesState:
|
|
|
1068
1067
|
return pulumi.get(self, "enable_online_bucket_repair")
|
|
1069
1068
|
|
|
1070
1069
|
@enable_online_bucket_repair.setter
|
|
1071
|
-
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[
|
|
1070
|
+
def enable_online_bucket_repair(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1072
1071
|
pulumi.set(self, "enable_online_bucket_repair", value)
|
|
1073
1072
|
|
|
1074
|
-
@property
|
|
1073
|
+
@_builtins.property
|
|
1075
1074
|
@pulumi.getter(name="frozenTimePeriodInSecs")
|
|
1076
|
-
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[
|
|
1075
|
+
def frozen_time_period_in_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1077
1076
|
"""
|
|
1078
1077
|
Number of seconds after which indexed data rolls to frozen.
|
|
1079
1078
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
@@ -1081,12 +1080,12 @@ class _IndexesState:
|
|
|
1081
1080
|
return pulumi.get(self, "frozen_time_period_in_secs")
|
|
1082
1081
|
|
|
1083
1082
|
@frozen_time_period_in_secs.setter
|
|
1084
|
-
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[
|
|
1083
|
+
def frozen_time_period_in_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1085
1084
|
pulumi.set(self, "frozen_time_period_in_secs", value)
|
|
1086
1085
|
|
|
1087
|
-
@property
|
|
1086
|
+
@_builtins.property
|
|
1088
1087
|
@pulumi.getter(name="homePath")
|
|
1089
|
-
def home_path(self) -> Optional[pulumi.Input[
|
|
1088
|
+
def home_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1090
1089
|
"""
|
|
1091
1090
|
An absolute path that contains the hot and warm buckets for the index.
|
|
1092
1091
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
@@ -1095,12 +1094,12 @@ class _IndexesState:
|
|
|
1095
1094
|
return pulumi.get(self, "home_path")
|
|
1096
1095
|
|
|
1097
1096
|
@home_path.setter
|
|
1098
|
-
def home_path(self, value: Optional[pulumi.Input[
|
|
1097
|
+
def home_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1099
1098
|
pulumi.set(self, "home_path", value)
|
|
1100
1099
|
|
|
1101
|
-
@property
|
|
1100
|
+
@_builtins.property
|
|
1102
1101
|
@pulumi.getter(name="maxBloomBackfillBucketAge")
|
|
1103
|
-
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[
|
|
1102
|
+
def max_bloom_backfill_bucket_age(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1104
1103
|
"""
|
|
1105
1104
|
Valid values are: Integer[m|s|h|d].
|
|
1106
1105
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
@@ -1108,12 +1107,12 @@ class _IndexesState:
|
|
|
1108
1107
|
return pulumi.get(self, "max_bloom_backfill_bucket_age")
|
|
1109
1108
|
|
|
1110
1109
|
@max_bloom_backfill_bucket_age.setter
|
|
1111
|
-
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[
|
|
1110
|
+
def max_bloom_backfill_bucket_age(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1112
1111
|
pulumi.set(self, "max_bloom_backfill_bucket_age", value)
|
|
1113
1112
|
|
|
1114
|
-
@property
|
|
1113
|
+
@_builtins.property
|
|
1115
1114
|
@pulumi.getter(name="maxConcurrentOptimizes")
|
|
1116
|
-
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[
|
|
1115
|
+
def max_concurrent_optimizes(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1117
1116
|
"""
|
|
1118
1117
|
The number of concurrent optimize processes that can run against a hot bucket.
|
|
1119
1118
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
@@ -1121,12 +1120,12 @@ class _IndexesState:
|
|
|
1121
1120
|
return pulumi.get(self, "max_concurrent_optimizes")
|
|
1122
1121
|
|
|
1123
1122
|
@max_concurrent_optimizes.setter
|
|
1124
|
-
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[
|
|
1123
|
+
def max_concurrent_optimizes(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1125
1124
|
pulumi.set(self, "max_concurrent_optimizes", value)
|
|
1126
1125
|
|
|
1127
|
-
@property
|
|
1126
|
+
@_builtins.property
|
|
1128
1127
|
@pulumi.getter(name="maxDataSize")
|
|
1129
|
-
def max_data_size(self) -> Optional[pulumi.Input[
|
|
1128
|
+
def max_data_size(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1130
1129
|
"""
|
|
1131
1130
|
The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1132
1131
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
@@ -1134,12 +1133,12 @@ class _IndexesState:
|
|
|
1134
1133
|
return pulumi.get(self, "max_data_size")
|
|
1135
1134
|
|
|
1136
1135
|
@max_data_size.setter
|
|
1137
|
-
def max_data_size(self, value: Optional[pulumi.Input[
|
|
1136
|
+
def max_data_size(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1138
1137
|
pulumi.set(self, "max_data_size", value)
|
|
1139
1138
|
|
|
1140
|
-
@property
|
|
1139
|
+
@_builtins.property
|
|
1141
1140
|
@pulumi.getter(name="maxHotBuckets")
|
|
1142
|
-
def max_hot_buckets(self) -> Optional[pulumi.Input[
|
|
1141
|
+
def max_hot_buckets(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1143
1142
|
"""
|
|
1144
1143
|
Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1145
1144
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
@@ -1147,60 +1146,60 @@ class _IndexesState:
|
|
|
1147
1146
|
return pulumi.get(self, "max_hot_buckets")
|
|
1148
1147
|
|
|
1149
1148
|
@max_hot_buckets.setter
|
|
1150
|
-
def max_hot_buckets(self, value: Optional[pulumi.Input[
|
|
1149
|
+
def max_hot_buckets(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1151
1150
|
pulumi.set(self, "max_hot_buckets", value)
|
|
1152
1151
|
|
|
1153
|
-
@property
|
|
1152
|
+
@_builtins.property
|
|
1154
1153
|
@pulumi.getter(name="maxHotIdleSecs")
|
|
1155
|
-
def max_hot_idle_secs(self) -> Optional[pulumi.Input[
|
|
1154
|
+
def max_hot_idle_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1156
1155
|
"""
|
|
1157
1156
|
Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1158
1157
|
"""
|
|
1159
1158
|
return pulumi.get(self, "max_hot_idle_secs")
|
|
1160
1159
|
|
|
1161
1160
|
@max_hot_idle_secs.setter
|
|
1162
|
-
def max_hot_idle_secs(self, value: Optional[pulumi.Input[
|
|
1161
|
+
def max_hot_idle_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1163
1162
|
pulumi.set(self, "max_hot_idle_secs", value)
|
|
1164
1163
|
|
|
1165
|
-
@property
|
|
1164
|
+
@_builtins.property
|
|
1166
1165
|
@pulumi.getter(name="maxHotSpanSecs")
|
|
1167
|
-
def max_hot_span_secs(self) -> Optional[pulumi.Input[
|
|
1166
|
+
def max_hot_span_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1168
1167
|
"""
|
|
1169
1168
|
Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1170
1169
|
"""
|
|
1171
1170
|
return pulumi.get(self, "max_hot_span_secs")
|
|
1172
1171
|
|
|
1173
1172
|
@max_hot_span_secs.setter
|
|
1174
|
-
def max_hot_span_secs(self, value: Optional[pulumi.Input[
|
|
1173
|
+
def max_hot_span_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1175
1174
|
pulumi.set(self, "max_hot_span_secs", value)
|
|
1176
1175
|
|
|
1177
|
-
@property
|
|
1176
|
+
@_builtins.property
|
|
1178
1177
|
@pulumi.getter(name="maxMemMb")
|
|
1179
|
-
def max_mem_mb(self) -> Optional[pulumi.Input[
|
|
1178
|
+
def max_mem_mb(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1180
1179
|
"""
|
|
1181
1180
|
The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1182
1181
|
"""
|
|
1183
1182
|
return pulumi.get(self, "max_mem_mb")
|
|
1184
1183
|
|
|
1185
1184
|
@max_mem_mb.setter
|
|
1186
|
-
def max_mem_mb(self, value: Optional[pulumi.Input[
|
|
1185
|
+
def max_mem_mb(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1187
1186
|
pulumi.set(self, "max_mem_mb", value)
|
|
1188
1187
|
|
|
1189
|
-
@property
|
|
1188
|
+
@_builtins.property
|
|
1190
1189
|
@pulumi.getter(name="maxMetaEntries")
|
|
1191
|
-
def max_meta_entries(self) -> Optional[pulumi.Input[
|
|
1190
|
+
def max_meta_entries(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1192
1191
|
"""
|
|
1193
1192
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1194
1193
|
"""
|
|
1195
1194
|
return pulumi.get(self, "max_meta_entries")
|
|
1196
1195
|
|
|
1197
1196
|
@max_meta_entries.setter
|
|
1198
|
-
def max_meta_entries(self, value: Optional[pulumi.Input[
|
|
1197
|
+
def max_meta_entries(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1199
1198
|
pulumi.set(self, "max_meta_entries", value)
|
|
1200
1199
|
|
|
1201
|
-
@property
|
|
1200
|
+
@_builtins.property
|
|
1202
1201
|
@pulumi.getter(name="maxTimeUnreplicatedNoAcks")
|
|
1203
|
-
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[
|
|
1202
|
+
def max_time_unreplicated_no_acks(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1204
1203
|
"""
|
|
1205
1204
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1206
1205
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
@@ -1209,12 +1208,12 @@ class _IndexesState:
|
|
|
1209
1208
|
return pulumi.get(self, "max_time_unreplicated_no_acks")
|
|
1210
1209
|
|
|
1211
1210
|
@max_time_unreplicated_no_acks.setter
|
|
1212
|
-
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[
|
|
1211
|
+
def max_time_unreplicated_no_acks(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1213
1212
|
pulumi.set(self, "max_time_unreplicated_no_acks", value)
|
|
1214
1213
|
|
|
1215
|
-
@property
|
|
1214
|
+
@_builtins.property
|
|
1216
1215
|
@pulumi.getter(name="maxTimeUnreplicatedWithAcks")
|
|
1217
|
-
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[
|
|
1216
|
+
def max_time_unreplicated_with_acks(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1218
1217
|
"""
|
|
1219
1218
|
Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1220
1219
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
@@ -1223,36 +1222,36 @@ class _IndexesState:
|
|
|
1223
1222
|
return pulumi.get(self, "max_time_unreplicated_with_acks")
|
|
1224
1223
|
|
|
1225
1224
|
@max_time_unreplicated_with_acks.setter
|
|
1226
|
-
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[
|
|
1225
|
+
def max_time_unreplicated_with_acks(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1227
1226
|
pulumi.set(self, "max_time_unreplicated_with_acks", value)
|
|
1228
1227
|
|
|
1229
|
-
@property
|
|
1228
|
+
@_builtins.property
|
|
1230
1229
|
@pulumi.getter(name="maxTotalDataSizeMb")
|
|
1231
|
-
def max_total_data_size_mb(self) -> Optional[pulumi.Input[
|
|
1230
|
+
def max_total_data_size_mb(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1232
1231
|
"""
|
|
1233
1232
|
The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1234
1233
|
"""
|
|
1235
1234
|
return pulumi.get(self, "max_total_data_size_mb")
|
|
1236
1235
|
|
|
1237
1236
|
@max_total_data_size_mb.setter
|
|
1238
|
-
def max_total_data_size_mb(self, value: Optional[pulumi.Input[
|
|
1237
|
+
def max_total_data_size_mb(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1239
1238
|
pulumi.set(self, "max_total_data_size_mb", value)
|
|
1240
1239
|
|
|
1241
|
-
@property
|
|
1240
|
+
@_builtins.property
|
|
1242
1241
|
@pulumi.getter(name="maxWarmDbCount")
|
|
1243
|
-
def max_warm_db_count(self) -> Optional[pulumi.Input[
|
|
1242
|
+
def max_warm_db_count(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1244
1243
|
"""
|
|
1245
1244
|
The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1246
1245
|
"""
|
|
1247
1246
|
return pulumi.get(self, "max_warm_db_count")
|
|
1248
1247
|
|
|
1249
1248
|
@max_warm_db_count.setter
|
|
1250
|
-
def max_warm_db_count(self, value: Optional[pulumi.Input[
|
|
1249
|
+
def max_warm_db_count(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1251
1250
|
pulumi.set(self, "max_warm_db_count", value)
|
|
1252
1251
|
|
|
1253
|
-
@property
|
|
1252
|
+
@_builtins.property
|
|
1254
1253
|
@pulumi.getter(name="minRawFileSyncSecs")
|
|
1255
|
-
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[
|
|
1254
|
+
def min_raw_file_sync_secs(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1256
1255
|
"""
|
|
1257
1256
|
Specify an integer (or "disable") for this parameter.
|
|
1258
1257
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
@@ -1262,36 +1261,36 @@ class _IndexesState:
|
|
|
1262
1261
|
return pulumi.get(self, "min_raw_file_sync_secs")
|
|
1263
1262
|
|
|
1264
1263
|
@min_raw_file_sync_secs.setter
|
|
1265
|
-
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[
|
|
1264
|
+
def min_raw_file_sync_secs(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1266
1265
|
pulumi.set(self, "min_raw_file_sync_secs", value)
|
|
1267
1266
|
|
|
1268
|
-
@property
|
|
1267
|
+
@_builtins.property
|
|
1269
1268
|
@pulumi.getter(name="minStreamGroupQueueSize")
|
|
1270
|
-
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[
|
|
1269
|
+
def min_stream_group_queue_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1271
1270
|
"""
|
|
1272
1271
|
Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1273
1272
|
"""
|
|
1274
1273
|
return pulumi.get(self, "min_stream_group_queue_size")
|
|
1275
1274
|
|
|
1276
1275
|
@min_stream_group_queue_size.setter
|
|
1277
|
-
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[
|
|
1276
|
+
def min_stream_group_queue_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1278
1277
|
pulumi.set(self, "min_stream_group_queue_size", value)
|
|
1279
1278
|
|
|
1280
|
-
@property
|
|
1279
|
+
@_builtins.property
|
|
1281
1280
|
@pulumi.getter
|
|
1282
|
-
def name(self) -> Optional[pulumi.Input[
|
|
1281
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1283
1282
|
"""
|
|
1284
1283
|
The name of the index to create.
|
|
1285
1284
|
"""
|
|
1286
1285
|
return pulumi.get(self, "name")
|
|
1287
1286
|
|
|
1288
1287
|
@name.setter
|
|
1289
|
-
def name(self, value: Optional[pulumi.Input[
|
|
1288
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1290
1289
|
pulumi.set(self, "name", value)
|
|
1291
1290
|
|
|
1292
|
-
@property
|
|
1291
|
+
@_builtins.property
|
|
1293
1292
|
@pulumi.getter(name="partialServiceMetaPeriod")
|
|
1294
|
-
def partial_service_meta_period(self) -> Optional[pulumi.Input[
|
|
1293
|
+
def partial_service_meta_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1295
1294
|
"""
|
|
1296
1295
|
Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1297
1296
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
@@ -1301,12 +1300,12 @@ class _IndexesState:
|
|
|
1301
1300
|
return pulumi.get(self, "partial_service_meta_period")
|
|
1302
1301
|
|
|
1303
1302
|
@partial_service_meta_period.setter
|
|
1304
|
-
def partial_service_meta_period(self, value: Optional[pulumi.Input[
|
|
1303
|
+
def partial_service_meta_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1305
1304
|
pulumi.set(self, "partial_service_meta_period", value)
|
|
1306
1305
|
|
|
1307
|
-
@property
|
|
1306
|
+
@_builtins.property
|
|
1308
1307
|
@pulumi.getter(name="processTrackerServiceInterval")
|
|
1309
|
-
def process_tracker_service_interval(self) -> Optional[pulumi.Input[
|
|
1308
|
+
def process_tracker_service_interval(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1310
1309
|
"""
|
|
1311
1310
|
Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1312
1311
|
If set to 0, the indexer checks child process status every second.
|
|
@@ -1315,12 +1314,12 @@ class _IndexesState:
|
|
|
1315
1314
|
return pulumi.get(self, "process_tracker_service_interval")
|
|
1316
1315
|
|
|
1317
1316
|
@process_tracker_service_interval.setter
|
|
1318
|
-
def process_tracker_service_interval(self, value: Optional[pulumi.Input[
|
|
1317
|
+
def process_tracker_service_interval(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1319
1318
|
pulumi.set(self, "process_tracker_service_interval", value)
|
|
1320
1319
|
|
|
1321
|
-
@property
|
|
1320
|
+
@_builtins.property
|
|
1322
1321
|
@pulumi.getter(name="quarantineFutureSecs")
|
|
1323
|
-
def quarantine_future_secs(self) -> Optional[pulumi.Input[
|
|
1322
|
+
def quarantine_future_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1324
1323
|
"""
|
|
1325
1324
|
Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1326
1325
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
@@ -1328,36 +1327,36 @@ class _IndexesState:
|
|
|
1328
1327
|
return pulumi.get(self, "quarantine_future_secs")
|
|
1329
1328
|
|
|
1330
1329
|
@quarantine_future_secs.setter
|
|
1331
|
-
def quarantine_future_secs(self, value: Optional[pulumi.Input[
|
|
1330
|
+
def quarantine_future_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1332
1331
|
pulumi.set(self, "quarantine_future_secs", value)
|
|
1333
1332
|
|
|
1334
|
-
@property
|
|
1333
|
+
@_builtins.property
|
|
1335
1334
|
@pulumi.getter(name="quarantinePastSecs")
|
|
1336
|
-
def quarantine_past_secs(self) -> Optional[pulumi.Input[
|
|
1335
|
+
def quarantine_past_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1337
1336
|
"""
|
|
1338
1337
|
Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1339
1338
|
"""
|
|
1340
1339
|
return pulumi.get(self, "quarantine_past_secs")
|
|
1341
1340
|
|
|
1342
1341
|
@quarantine_past_secs.setter
|
|
1343
|
-
def quarantine_past_secs(self, value: Optional[pulumi.Input[
|
|
1342
|
+
def quarantine_past_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1344
1343
|
pulumi.set(self, "quarantine_past_secs", value)
|
|
1345
1344
|
|
|
1346
|
-
@property
|
|
1345
|
+
@_builtins.property
|
|
1347
1346
|
@pulumi.getter(name="rawChunkSizeBytes")
|
|
1348
|
-
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[
|
|
1347
|
+
def raw_chunk_size_bytes(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1349
1348
|
"""
|
|
1350
1349
|
Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1351
1350
|
"""
|
|
1352
1351
|
return pulumi.get(self, "raw_chunk_size_bytes")
|
|
1353
1352
|
|
|
1354
1353
|
@raw_chunk_size_bytes.setter
|
|
1355
|
-
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[
|
|
1354
|
+
def raw_chunk_size_bytes(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1356
1355
|
pulumi.set(self, "raw_chunk_size_bytes", value)
|
|
1357
1356
|
|
|
1358
|
-
@property
|
|
1357
|
+
@_builtins.property
|
|
1359
1358
|
@pulumi.getter(name="repFactor")
|
|
1360
|
-
def rep_factor(self) -> Optional[pulumi.Input[
|
|
1359
|
+
def rep_factor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1361
1360
|
"""
|
|
1362
1361
|
Index replication control. This parameter applies to only clustering slaves.
|
|
1363
1362
|
auto = Use the master index replication configuration value.
|
|
@@ -1366,24 +1365,24 @@ class _IndexesState:
|
|
|
1366
1365
|
return pulumi.get(self, "rep_factor")
|
|
1367
1366
|
|
|
1368
1367
|
@rep_factor.setter
|
|
1369
|
-
def rep_factor(self, value: Optional[pulumi.Input[
|
|
1368
|
+
def rep_factor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1370
1369
|
pulumi.set(self, "rep_factor", value)
|
|
1371
1370
|
|
|
1372
|
-
@property
|
|
1371
|
+
@_builtins.property
|
|
1373
1372
|
@pulumi.getter(name="rotatePeriodInSecs")
|
|
1374
|
-
def rotate_period_in_secs(self) -> Optional[pulumi.Input[
|
|
1373
|
+
def rotate_period_in_secs(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1375
1374
|
"""
|
|
1376
1375
|
How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1377
1376
|
"""
|
|
1378
1377
|
return pulumi.get(self, "rotate_period_in_secs")
|
|
1379
1378
|
|
|
1380
1379
|
@rotate_period_in_secs.setter
|
|
1381
|
-
def rotate_period_in_secs(self, value: Optional[pulumi.Input[
|
|
1380
|
+
def rotate_period_in_secs(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1382
1381
|
pulumi.set(self, "rotate_period_in_secs", value)
|
|
1383
1382
|
|
|
1384
|
-
@property
|
|
1383
|
+
@_builtins.property
|
|
1385
1384
|
@pulumi.getter(name="serviceMetaPeriod")
|
|
1386
|
-
def service_meta_period(self) -> Optional[pulumi.Input[
|
|
1385
|
+
def service_meta_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1387
1386
|
"""
|
|
1388
1387
|
Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1389
1388
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
@@ -1391,24 +1390,24 @@ class _IndexesState:
|
|
|
1391
1390
|
return pulumi.get(self, "service_meta_period")
|
|
1392
1391
|
|
|
1393
1392
|
@service_meta_period.setter
|
|
1394
|
-
def service_meta_period(self, value: Optional[pulumi.Input[
|
|
1393
|
+
def service_meta_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1395
1394
|
pulumi.set(self, "service_meta_period", value)
|
|
1396
1395
|
|
|
1397
|
-
@property
|
|
1396
|
+
@_builtins.property
|
|
1398
1397
|
@pulumi.getter(name="syncMeta")
|
|
1399
|
-
def sync_meta(self) -> Optional[pulumi.Input[
|
|
1398
|
+
def sync_meta(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1400
1399
|
"""
|
|
1401
1400
|
When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1402
1401
|
"""
|
|
1403
1402
|
return pulumi.get(self, "sync_meta")
|
|
1404
1403
|
|
|
1405
1404
|
@sync_meta.setter
|
|
1406
|
-
def sync_meta(self, value: Optional[pulumi.Input[
|
|
1405
|
+
def sync_meta(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1407
1406
|
pulumi.set(self, "sync_meta", value)
|
|
1408
1407
|
|
|
1409
|
-
@property
|
|
1408
|
+
@_builtins.property
|
|
1410
1409
|
@pulumi.getter(name="thawedPath")
|
|
1411
|
-
def thawed_path(self) -> Optional[pulumi.Input[
|
|
1410
|
+
def thawed_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1412
1411
|
"""
|
|
1413
1412
|
An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1414
1413
|
Cannot be defined in terms of a volume definition.
|
|
@@ -1417,24 +1416,24 @@ class _IndexesState:
|
|
|
1417
1416
|
return pulumi.get(self, "thawed_path")
|
|
1418
1417
|
|
|
1419
1418
|
@thawed_path.setter
|
|
1420
|
-
def thawed_path(self, value: Optional[pulumi.Input[
|
|
1419
|
+
def thawed_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1421
1420
|
pulumi.set(self, "thawed_path", value)
|
|
1422
1421
|
|
|
1423
|
-
@property
|
|
1422
|
+
@_builtins.property
|
|
1424
1423
|
@pulumi.getter(name="throttleCheckPeriod")
|
|
1425
|
-
def throttle_check_period(self) -> Optional[pulumi.Input[
|
|
1424
|
+
def throttle_check_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1426
1425
|
"""
|
|
1427
1426
|
Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1428
1427
|
"""
|
|
1429
1428
|
return pulumi.get(self, "throttle_check_period")
|
|
1430
1429
|
|
|
1431
1430
|
@throttle_check_period.setter
|
|
1432
|
-
def throttle_check_period(self, value: Optional[pulumi.Input[
|
|
1431
|
+
def throttle_check_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1433
1432
|
pulumi.set(self, "throttle_check_period", value)
|
|
1434
1433
|
|
|
1435
|
-
@property
|
|
1434
|
+
@_builtins.property
|
|
1436
1435
|
@pulumi.getter(name="tstatsHomePath")
|
|
1437
|
-
def tstats_home_path(self) -> Optional[pulumi.Input[
|
|
1436
|
+
def tstats_home_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1438
1437
|
"""
|
|
1439
1438
|
Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1440
1439
|
If specified, it must be defined in terms of a volume definition.
|
|
@@ -1442,12 +1441,12 @@ class _IndexesState:
|
|
|
1442
1441
|
return pulumi.get(self, "tstats_home_path")
|
|
1443
1442
|
|
|
1444
1443
|
@tstats_home_path.setter
|
|
1445
|
-
def tstats_home_path(self, value: Optional[pulumi.Input[
|
|
1444
|
+
def tstats_home_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1446
1445
|
pulumi.set(self, "tstats_home_path", value)
|
|
1447
1446
|
|
|
1448
|
-
@property
|
|
1447
|
+
@_builtins.property
|
|
1449
1448
|
@pulumi.getter(name="warmToColdScript")
|
|
1450
|
-
def warm_to_cold_script(self) -> Optional[pulumi.Input[
|
|
1449
|
+
def warm_to_cold_script(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1451
1450
|
"""
|
|
1452
1451
|
Path to a script to run when moving data from warm to cold.
|
|
1453
1452
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
@@ -1455,54 +1454,55 @@ class _IndexesState:
|
|
|
1455
1454
|
return pulumi.get(self, "warm_to_cold_script")
|
|
1456
1455
|
|
|
1457
1456
|
@warm_to_cold_script.setter
|
|
1458
|
-
def warm_to_cold_script(self, value: Optional[pulumi.Input[
|
|
1457
|
+
def warm_to_cold_script(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1459
1458
|
pulumi.set(self, "warm_to_cold_script", value)
|
|
1460
1459
|
|
|
1461
1460
|
|
|
1461
|
+
@pulumi.type_token("splunk:index/indexes:Indexes")
|
|
1462
1462
|
class Indexes(pulumi.CustomResource):
|
|
1463
1463
|
@overload
|
|
1464
1464
|
def __init__(__self__,
|
|
1465
1465
|
resource_name: str,
|
|
1466
1466
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1467
1467
|
acl: Optional[pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']]] = None,
|
|
1468
|
-
block_sign_size: Optional[pulumi.Input[
|
|
1469
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[
|
|
1470
|
-
cold_path: Optional[pulumi.Input[
|
|
1471
|
-
cold_to_frozen_dir: Optional[pulumi.Input[
|
|
1472
|
-
cold_to_frozen_script: Optional[pulumi.Input[
|
|
1473
|
-
compress_rawdata: Optional[pulumi.Input[
|
|
1474
|
-
datatype: Optional[pulumi.Input[
|
|
1475
|
-
enable_online_bucket_repair: Optional[pulumi.Input[
|
|
1476
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[
|
|
1477
|
-
home_path: Optional[pulumi.Input[
|
|
1478
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[
|
|
1479
|
-
max_concurrent_optimizes: Optional[pulumi.Input[
|
|
1480
|
-
max_data_size: Optional[pulumi.Input[
|
|
1481
|
-
max_hot_buckets: Optional[pulumi.Input[
|
|
1482
|
-
max_hot_idle_secs: Optional[pulumi.Input[
|
|
1483
|
-
max_hot_span_secs: Optional[pulumi.Input[
|
|
1484
|
-
max_mem_mb: Optional[pulumi.Input[
|
|
1485
|
-
max_meta_entries: Optional[pulumi.Input[
|
|
1486
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[
|
|
1487
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[
|
|
1488
|
-
max_total_data_size_mb: Optional[pulumi.Input[
|
|
1489
|
-
max_warm_db_count: Optional[pulumi.Input[
|
|
1490
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[
|
|
1491
|
-
min_stream_group_queue_size: Optional[pulumi.Input[
|
|
1492
|
-
name: Optional[pulumi.Input[
|
|
1493
|
-
partial_service_meta_period: Optional[pulumi.Input[
|
|
1494
|
-
process_tracker_service_interval: Optional[pulumi.Input[
|
|
1495
|
-
quarantine_future_secs: Optional[pulumi.Input[
|
|
1496
|
-
quarantine_past_secs: Optional[pulumi.Input[
|
|
1497
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[
|
|
1498
|
-
rep_factor: Optional[pulumi.Input[
|
|
1499
|
-
rotate_period_in_secs: Optional[pulumi.Input[
|
|
1500
|
-
service_meta_period: Optional[pulumi.Input[
|
|
1501
|
-
sync_meta: Optional[pulumi.Input[
|
|
1502
|
-
thawed_path: Optional[pulumi.Input[
|
|
1503
|
-
throttle_check_period: Optional[pulumi.Input[
|
|
1504
|
-
tstats_home_path: Optional[pulumi.Input[
|
|
1505
|
-
warm_to_cold_script: Optional[pulumi.Input[
|
|
1468
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1469
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1470
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1471
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1472
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1473
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1474
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1475
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1476
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1477
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1478
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1479
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1480
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1481
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1482
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1483
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1484
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1485
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1486
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1487
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1488
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1489
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1490
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1491
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1492
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1493
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1494
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1495
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1496
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1497
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1498
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1499
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1500
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1501
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1502
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1503
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1504
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1505
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1506
1506
|
__props__=None):
|
|
1507
1507
|
"""
|
|
1508
1508
|
## # Resource: Indexes
|
|
@@ -1529,16 +1529,16 @@ class Indexes(pulumi.CustomResource):
|
|
|
1529
1529
|
:param str resource_name: The name of the resource.
|
|
1530
1530
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1531
1531
|
:param pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']] acl: The app/user context that is the namespace for the resource
|
|
1532
|
-
:param pulumi.Input[
|
|
1533
|
-
:param pulumi.Input[
|
|
1532
|
+
:param pulumi.Input[_builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1533
|
+
:param pulumi.Input[_builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1534
1534
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
1535
1535
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
1536
1536
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
1537
1537
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
1538
1538
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
1539
1539
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
1540
|
-
:param pulumi.Input[
|
|
1541
|
-
:param pulumi.Input[
|
|
1540
|
+
:param pulumi.Input[_builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1541
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1542
1542
|
<br>
|
|
1543
1543
|
Bucket freezing policy is as follows:<br>
|
|
1544
1544
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -1546,70 +1546,70 @@ class Indexes(pulumi.CustomResource):
|
|
|
1546
1546
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
1547
1547
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
1548
1548
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
1549
|
-
:param pulumi.Input[
|
|
1549
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
1550
1550
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
1551
1551
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
1552
1552
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
1553
|
-
:param pulumi.Input[
|
|
1554
|
-
:param pulumi.Input[
|
|
1555
|
-
:param pulumi.Input[
|
|
1553
|
+
:param pulumi.Input[_builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1554
|
+
:param pulumi.Input[_builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1555
|
+
:param pulumi.Input[_builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1556
1556
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
1557
|
-
:param pulumi.Input[
|
|
1557
|
+
:param pulumi.Input[_builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1558
1558
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
1559
|
-
:param pulumi.Input[
|
|
1559
|
+
:param pulumi.Input[_builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1560
1560
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
1561
1561
|
<br>Caution: The path must be readable and writable.
|
|
1562
|
-
:param pulumi.Input[
|
|
1562
|
+
:param pulumi.Input[_builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1563
1563
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
1564
|
-
:param pulumi.Input[
|
|
1564
|
+
:param pulumi.Input[_builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1565
1565
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
1566
|
-
:param pulumi.Input[
|
|
1566
|
+
:param pulumi.Input[_builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1567
1567
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
1568
|
-
:param pulumi.Input[
|
|
1568
|
+
:param pulumi.Input[_builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1569
1569
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
1570
|
-
:param pulumi.Input[
|
|
1571
|
-
:param pulumi.Input[
|
|
1572
|
-
:param pulumi.Input[
|
|
1573
|
-
:param pulumi.Input[
|
|
1574
|
-
:param pulumi.Input[
|
|
1570
|
+
:param pulumi.Input[_builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1571
|
+
:param pulumi.Input[_builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1572
|
+
:param pulumi.Input[_builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1573
|
+
:param pulumi.Input[_builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1574
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1575
1575
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
1576
1576
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1577
|
-
:param pulumi.Input[
|
|
1577
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1578
1578
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
1579
1579
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
1580
|
-
:param pulumi.Input[
|
|
1581
|
-
:param pulumi.Input[
|
|
1582
|
-
:param pulumi.Input[
|
|
1580
|
+
:param pulumi.Input[_builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1581
|
+
:param pulumi.Input[_builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1582
|
+
:param pulumi.Input[_builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1583
1583
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
1584
1584
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
1585
1585
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
1586
|
-
:param pulumi.Input[
|
|
1587
|
-
:param pulumi.Input[
|
|
1588
|
-
:param pulumi.Input[
|
|
1586
|
+
:param pulumi.Input[_builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1587
|
+
:param pulumi.Input[_builtins.str] name: The name of the index to create.
|
|
1588
|
+
:param pulumi.Input[_builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1589
1589
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
1590
1590
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
1591
1591
|
By default it is turned off (zero).
|
|
1592
|
-
:param pulumi.Input[
|
|
1592
|
+
:param pulumi.Input[_builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1593
1593
|
If set to 0, the indexer checks child process status every second.
|
|
1594
1594
|
Highest legal value is 4294967295.
|
|
1595
|
-
:param pulumi.Input[
|
|
1595
|
+
:param pulumi.Input[_builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1596
1596
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
1597
|
-
:param pulumi.Input[
|
|
1598
|
-
:param pulumi.Input[
|
|
1599
|
-
:param pulumi.Input[
|
|
1597
|
+
:param pulumi.Input[_builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1598
|
+
:param pulumi.Input[_builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1599
|
+
:param pulumi.Input[_builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1600
1600
|
auto = Use the master index replication configuration value.
|
|
1601
1601
|
0 = Turn off replication for this index.
|
|
1602
|
-
:param pulumi.Input[
|
|
1603
|
-
:param pulumi.Input[
|
|
1602
|
+
:param pulumi.Input[_builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1603
|
+
:param pulumi.Input[_builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1604
1604
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
1605
|
-
:param pulumi.Input[
|
|
1606
|
-
:param pulumi.Input[
|
|
1605
|
+
:param pulumi.Input[_builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1606
|
+
:param pulumi.Input[_builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1607
1607
|
Cannot be defined in terms of a volume definition.
|
|
1608
1608
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
1609
|
-
:param pulumi.Input[
|
|
1610
|
-
:param pulumi.Input[
|
|
1609
|
+
:param pulumi.Input[_builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1610
|
+
:param pulumi.Input[_builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1611
1611
|
If specified, it must be defined in terms of a volume definition.
|
|
1612
|
-
:param pulumi.Input[
|
|
1612
|
+
:param pulumi.Input[_builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1613
1613
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
1614
1614
|
"""
|
|
1615
1615
|
...
|
|
@@ -1656,44 +1656,44 @@ class Indexes(pulumi.CustomResource):
|
|
|
1656
1656
|
resource_name: str,
|
|
1657
1657
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1658
1658
|
acl: Optional[pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']]] = None,
|
|
1659
|
-
block_sign_size: Optional[pulumi.Input[
|
|
1660
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[
|
|
1661
|
-
cold_path: Optional[pulumi.Input[
|
|
1662
|
-
cold_to_frozen_dir: Optional[pulumi.Input[
|
|
1663
|
-
cold_to_frozen_script: Optional[pulumi.Input[
|
|
1664
|
-
compress_rawdata: Optional[pulumi.Input[
|
|
1665
|
-
datatype: Optional[pulumi.Input[
|
|
1666
|
-
enable_online_bucket_repair: Optional[pulumi.Input[
|
|
1667
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[
|
|
1668
|
-
home_path: Optional[pulumi.Input[
|
|
1669
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[
|
|
1670
|
-
max_concurrent_optimizes: Optional[pulumi.Input[
|
|
1671
|
-
max_data_size: Optional[pulumi.Input[
|
|
1672
|
-
max_hot_buckets: Optional[pulumi.Input[
|
|
1673
|
-
max_hot_idle_secs: Optional[pulumi.Input[
|
|
1674
|
-
max_hot_span_secs: Optional[pulumi.Input[
|
|
1675
|
-
max_mem_mb: Optional[pulumi.Input[
|
|
1676
|
-
max_meta_entries: Optional[pulumi.Input[
|
|
1677
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[
|
|
1678
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[
|
|
1679
|
-
max_total_data_size_mb: Optional[pulumi.Input[
|
|
1680
|
-
max_warm_db_count: Optional[pulumi.Input[
|
|
1681
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[
|
|
1682
|
-
min_stream_group_queue_size: Optional[pulumi.Input[
|
|
1683
|
-
name: Optional[pulumi.Input[
|
|
1684
|
-
partial_service_meta_period: Optional[pulumi.Input[
|
|
1685
|
-
process_tracker_service_interval: Optional[pulumi.Input[
|
|
1686
|
-
quarantine_future_secs: Optional[pulumi.Input[
|
|
1687
|
-
quarantine_past_secs: Optional[pulumi.Input[
|
|
1688
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[
|
|
1689
|
-
rep_factor: Optional[pulumi.Input[
|
|
1690
|
-
rotate_period_in_secs: Optional[pulumi.Input[
|
|
1691
|
-
service_meta_period: Optional[pulumi.Input[
|
|
1692
|
-
sync_meta: Optional[pulumi.Input[
|
|
1693
|
-
thawed_path: Optional[pulumi.Input[
|
|
1694
|
-
throttle_check_period: Optional[pulumi.Input[
|
|
1695
|
-
tstats_home_path: Optional[pulumi.Input[
|
|
1696
|
-
warm_to_cold_script: Optional[pulumi.Input[
|
|
1659
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1660
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1661
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1662
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1663
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1664
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1665
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1666
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1667
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1668
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1669
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1670
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1671
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1672
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1673
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1674
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1675
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1676
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1677
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1678
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1679
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1680
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1681
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1682
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1683
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1684
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1685
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1686
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1687
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1688
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1689
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1690
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1691
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1692
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1693
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1694
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1695
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1696
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1697
1697
|
__props__=None):
|
|
1698
1698
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
1699
1699
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -1753,44 +1753,44 @@ class Indexes(pulumi.CustomResource):
|
|
|
1753
1753
|
id: pulumi.Input[str],
|
|
1754
1754
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1755
1755
|
acl: Optional[pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']]] = None,
|
|
1756
|
-
block_sign_size: Optional[pulumi.Input[
|
|
1757
|
-
bucket_rebuild_memory_hint: Optional[pulumi.Input[
|
|
1758
|
-
cold_path: Optional[pulumi.Input[
|
|
1759
|
-
cold_to_frozen_dir: Optional[pulumi.Input[
|
|
1760
|
-
cold_to_frozen_script: Optional[pulumi.Input[
|
|
1761
|
-
compress_rawdata: Optional[pulumi.Input[
|
|
1762
|
-
datatype: Optional[pulumi.Input[
|
|
1763
|
-
enable_online_bucket_repair: Optional[pulumi.Input[
|
|
1764
|
-
frozen_time_period_in_secs: Optional[pulumi.Input[
|
|
1765
|
-
home_path: Optional[pulumi.Input[
|
|
1766
|
-
max_bloom_backfill_bucket_age: Optional[pulumi.Input[
|
|
1767
|
-
max_concurrent_optimizes: Optional[pulumi.Input[
|
|
1768
|
-
max_data_size: Optional[pulumi.Input[
|
|
1769
|
-
max_hot_buckets: Optional[pulumi.Input[
|
|
1770
|
-
max_hot_idle_secs: Optional[pulumi.Input[
|
|
1771
|
-
max_hot_span_secs: Optional[pulumi.Input[
|
|
1772
|
-
max_mem_mb: Optional[pulumi.Input[
|
|
1773
|
-
max_meta_entries: Optional[pulumi.Input[
|
|
1774
|
-
max_time_unreplicated_no_acks: Optional[pulumi.Input[
|
|
1775
|
-
max_time_unreplicated_with_acks: Optional[pulumi.Input[
|
|
1776
|
-
max_total_data_size_mb: Optional[pulumi.Input[
|
|
1777
|
-
max_warm_db_count: Optional[pulumi.Input[
|
|
1778
|
-
min_raw_file_sync_secs: Optional[pulumi.Input[
|
|
1779
|
-
min_stream_group_queue_size: Optional[pulumi.Input[
|
|
1780
|
-
name: Optional[pulumi.Input[
|
|
1781
|
-
partial_service_meta_period: Optional[pulumi.Input[
|
|
1782
|
-
process_tracker_service_interval: Optional[pulumi.Input[
|
|
1783
|
-
quarantine_future_secs: Optional[pulumi.Input[
|
|
1784
|
-
quarantine_past_secs: Optional[pulumi.Input[
|
|
1785
|
-
raw_chunk_size_bytes: Optional[pulumi.Input[
|
|
1786
|
-
rep_factor: Optional[pulumi.Input[
|
|
1787
|
-
rotate_period_in_secs: Optional[pulumi.Input[
|
|
1788
|
-
service_meta_period: Optional[pulumi.Input[
|
|
1789
|
-
sync_meta: Optional[pulumi.Input[
|
|
1790
|
-
thawed_path: Optional[pulumi.Input[
|
|
1791
|
-
throttle_check_period: Optional[pulumi.Input[
|
|
1792
|
-
tstats_home_path: Optional[pulumi.Input[
|
|
1793
|
-
warm_to_cold_script: Optional[pulumi.Input[
|
|
1756
|
+
block_sign_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1757
|
+
bucket_rebuild_memory_hint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1758
|
+
cold_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1759
|
+
cold_to_frozen_dir: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1760
|
+
cold_to_frozen_script: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1761
|
+
compress_rawdata: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1762
|
+
datatype: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1763
|
+
enable_online_bucket_repair: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1764
|
+
frozen_time_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1765
|
+
home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1766
|
+
max_bloom_backfill_bucket_age: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1767
|
+
max_concurrent_optimizes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1768
|
+
max_data_size: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1769
|
+
max_hot_buckets: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1770
|
+
max_hot_idle_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1771
|
+
max_hot_span_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1772
|
+
max_mem_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1773
|
+
max_meta_entries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1774
|
+
max_time_unreplicated_no_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1775
|
+
max_time_unreplicated_with_acks: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1776
|
+
max_total_data_size_mb: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1777
|
+
max_warm_db_count: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1778
|
+
min_raw_file_sync_secs: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1779
|
+
min_stream_group_queue_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1780
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1781
|
+
partial_service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1782
|
+
process_tracker_service_interval: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1783
|
+
quarantine_future_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1784
|
+
quarantine_past_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1785
|
+
raw_chunk_size_bytes: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1786
|
+
rep_factor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1787
|
+
rotate_period_in_secs: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1788
|
+
service_meta_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1789
|
+
sync_meta: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1790
|
+
thawed_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1791
|
+
throttle_check_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1792
|
+
tstats_home_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1793
|
+
warm_to_cold_script: Optional[pulumi.Input[_builtins.str]] = None) -> 'Indexes':
|
|
1794
1794
|
"""
|
|
1795
1795
|
Get an existing Indexes resource's state with the given name, id, and optional extra
|
|
1796
1796
|
properties used to qualify the lookup.
|
|
@@ -1799,16 +1799,16 @@ class Indexes(pulumi.CustomResource):
|
|
|
1799
1799
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
1800
1800
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1801
1801
|
:param pulumi.Input[Union['IndexesAclArgs', 'IndexesAclArgsDict']] acl: The app/user context that is the namespace for the resource
|
|
1802
|
-
:param pulumi.Input[
|
|
1803
|
-
:param pulumi.Input[
|
|
1802
|
+
:param pulumi.Input[_builtins.int] block_sign_size: Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1803
|
+
:param pulumi.Input[_builtins.str] bucket_rebuild_memory_hint: Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1804
1804
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
1805
1805
|
Default value, auto, varies by the amount of physical RAM on the host<br>
|
|
1806
1806
|
less than 2GB RAM = 67108864 (64MB) tsidx
|
|
1807
1807
|
2GB to 8GB RAM = 134217728 (128MB) tsidx
|
|
1808
1808
|
more than 8GB RAM = 268435456 (256MB) tsidx<br>
|
|
1809
1809
|
Values other than "auto" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: "16777216" or "16MB" are equivalent.
|
|
1810
|
-
:param pulumi.Input[
|
|
1811
|
-
:param pulumi.Input[
|
|
1810
|
+
:param pulumi.Input[_builtins.str] cold_path: An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1811
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_dir: Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1812
1812
|
<br>
|
|
1813
1813
|
Bucket freezing policy is as follows:<br>
|
|
1814
1814
|
New style buckets (4.2 and on): removes all files but the rawdata<br>
|
|
@@ -1816,70 +1816,70 @@ class Indexes(pulumi.CustomResource):
|
|
|
1816
1816
|
Old style buckets (Pre-4.2): gzip all the .data and .tsidx files<br>
|
|
1817
1817
|
To thaw, gunzip the zipped files and move the bucket into the thawed directory<br>
|
|
1818
1818
|
If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence
|
|
1819
|
-
:param pulumi.Input[
|
|
1819
|
+
:param pulumi.Input[_builtins.str] cold_to_frozen_script: Path to the archiving script.
|
|
1820
1820
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
1821
1821
|
<br>Splunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.
|
|
1822
1822
|
<br>It is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.
|
|
1823
|
-
:param pulumi.Input[
|
|
1824
|
-
:param pulumi.Input[
|
|
1825
|
-
:param pulumi.Input[
|
|
1823
|
+
:param pulumi.Input[_builtins.bool] compress_rawdata: This parameter is ignored. The splunkd process always compresses raw data.
|
|
1824
|
+
:param pulumi.Input[_builtins.str] datatype: Valid values: (event | metric). Specifies the type of index.
|
|
1825
|
+
:param pulumi.Input[_builtins.bool] enable_online_bucket_repair: Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
1826
1826
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
1827
|
-
:param pulumi.Input[
|
|
1827
|
+
:param pulumi.Input[_builtins.int] frozen_time_period_in_secs: Number of seconds after which indexed data rolls to frozen.
|
|
1828
1828
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
1829
|
-
:param pulumi.Input[
|
|
1829
|
+
:param pulumi.Input[_builtins.str] home_path: An absolute path that contains the hot and warm buckets for the index.
|
|
1830
1830
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
1831
1831
|
<br>Caution: The path must be readable and writable.
|
|
1832
|
-
:param pulumi.Input[
|
|
1832
|
+
:param pulumi.Input[_builtins.str] max_bloom_backfill_bucket_age: Valid values are: Integer[m|s|h|d].
|
|
1833
1833
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
1834
|
-
:param pulumi.Input[
|
|
1834
|
+
:param pulumi.Input[_builtins.int] max_concurrent_optimizes: The number of concurrent optimize processes that can run against a hot bucket.
|
|
1835
1835
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
1836
|
-
:param pulumi.Input[
|
|
1836
|
+
:param pulumi.Input[_builtins.str] max_data_size: The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
1837
1837
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
1838
|
-
:param pulumi.Input[
|
|
1838
|
+
:param pulumi.Input[_builtins.int] max_hot_buckets: Maximum hot buckets that can exist per index. Defaults to 3.
|
|
1839
1839
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
1840
|
-
:param pulumi.Input[
|
|
1841
|
-
:param pulumi.Input[
|
|
1842
|
-
:param pulumi.Input[
|
|
1843
|
-
:param pulumi.Input[
|
|
1844
|
-
:param pulumi.Input[
|
|
1840
|
+
:param pulumi.Input[_builtins.int] max_hot_idle_secs: Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
1841
|
+
:param pulumi.Input[_builtins.int] max_hot_span_secs: Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
1842
|
+
:param pulumi.Input[_builtins.int] max_mem_mb: The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
1843
|
+
:param pulumi.Input[_builtins.int] max_meta_entries: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1844
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_no_acks: Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
1845
1845
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
1846
1846
|
Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
1847
|
-
:param pulumi.Input[
|
|
1847
|
+
:param pulumi.Input[_builtins.int] max_time_unreplicated_with_acks: Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
1848
1848
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
1849
1849
|
To disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.
|
|
1850
|
-
:param pulumi.Input[
|
|
1851
|
-
:param pulumi.Input[
|
|
1852
|
-
:param pulumi.Input[
|
|
1850
|
+
:param pulumi.Input[_builtins.int] max_total_data_size_mb: The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
1851
|
+
:param pulumi.Input[_builtins.int] max_warm_db_count: The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
1852
|
+
:param pulumi.Input[_builtins.str] min_raw_file_sync_secs: Specify an integer (or "disable") for this parameter.
|
|
1853
1853
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
1854
1854
|
During this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.
|
|
1855
1855
|
If 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying "disable" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.
|
|
1856
|
-
:param pulumi.Input[
|
|
1857
|
-
:param pulumi.Input[
|
|
1858
|
-
:param pulumi.Input[
|
|
1856
|
+
:param pulumi.Input[_builtins.int] min_stream_group_queue_size: Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
1857
|
+
:param pulumi.Input[_builtins.str] name: The name of the index to create.
|
|
1858
|
+
:param pulumi.Input[_builtins.int] partial_service_meta_period: Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
1859
1859
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
1860
1860
|
If the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.
|
|
1861
1861
|
By default it is turned off (zero).
|
|
1862
|
-
:param pulumi.Input[
|
|
1862
|
+
:param pulumi.Input[_builtins.int] process_tracker_service_interval: Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
1863
1863
|
If set to 0, the indexer checks child process status every second.
|
|
1864
1864
|
Highest legal value is 4294967295.
|
|
1865
|
-
:param pulumi.Input[
|
|
1865
|
+
:param pulumi.Input[_builtins.int] quarantine_future_secs: Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
1866
1866
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
1867
|
-
:param pulumi.Input[
|
|
1868
|
-
:param pulumi.Input[
|
|
1869
|
-
:param pulumi.Input[
|
|
1867
|
+
:param pulumi.Input[_builtins.int] quarantine_past_secs: Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
1868
|
+
:param pulumi.Input[_builtins.int] raw_chunk_size_bytes: Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
1869
|
+
:param pulumi.Input[_builtins.str] rep_factor: Index replication control. This parameter applies to only clustering slaves.
|
|
1870
1870
|
auto = Use the master index replication configuration value.
|
|
1871
1871
|
0 = Turn off replication for this index.
|
|
1872
|
-
:param pulumi.Input[
|
|
1873
|
-
:param pulumi.Input[
|
|
1872
|
+
:param pulumi.Input[_builtins.int] rotate_period_in_secs: How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
1873
|
+
:param pulumi.Input[_builtins.int] service_meta_period: Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
1874
1874
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
1875
|
-
:param pulumi.Input[
|
|
1876
|
-
:param pulumi.Input[
|
|
1875
|
+
:param pulumi.Input[_builtins.bool] sync_meta: When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
1876
|
+
:param pulumi.Input[_builtins.str] thawed_path: An absolute path that contains the thawed (resurrected) databases for the index.
|
|
1877
1877
|
Cannot be defined in terms of a volume definition.
|
|
1878
1878
|
Required. Splunk software does not start if an index lacks a valid thawedPath.
|
|
1879
|
-
:param pulumi.Input[
|
|
1880
|
-
:param pulumi.Input[
|
|
1879
|
+
:param pulumi.Input[_builtins.int] throttle_check_period: Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
1880
|
+
:param pulumi.Input[_builtins.str] tstats_home_path: Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
1881
1881
|
If specified, it must be defined in terms of a volume definition.
|
|
1882
|
-
:param pulumi.Input[
|
|
1882
|
+
:param pulumi.Input[_builtins.str] warm_to_cold_script: Path to a script to run when moving data from warm to cold.
|
|
1883
1883
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|
|
1884
1884
|
"""
|
|
1885
1885
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
@@ -1927,7 +1927,7 @@ class Indexes(pulumi.CustomResource):
|
|
|
1927
1927
|
__props__.__dict__["warm_to_cold_script"] = warm_to_cold_script
|
|
1928
1928
|
return Indexes(resource_name, opts=opts, __props__=__props__)
|
|
1929
1929
|
|
|
1930
|
-
@property
|
|
1930
|
+
@_builtins.property
|
|
1931
1931
|
@pulumi.getter
|
|
1932
1932
|
def acl(self) -> pulumi.Output['outputs.IndexesAcl']:
|
|
1933
1933
|
"""
|
|
@@ -1935,17 +1935,17 @@ class Indexes(pulumi.CustomResource):
|
|
|
1935
1935
|
"""
|
|
1936
1936
|
return pulumi.get(self, "acl")
|
|
1937
1937
|
|
|
1938
|
-
@property
|
|
1938
|
+
@_builtins.property
|
|
1939
1939
|
@pulumi.getter(name="blockSignSize")
|
|
1940
|
-
def block_sign_size(self) -> pulumi.Output[
|
|
1940
|
+
def block_sign_size(self) -> pulumi.Output[_builtins.int]:
|
|
1941
1941
|
"""
|
|
1942
1942
|
Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. <br>A recommended value is 100.
|
|
1943
1943
|
"""
|
|
1944
1944
|
return pulumi.get(self, "block_sign_size")
|
|
1945
1945
|
|
|
1946
|
-
@property
|
|
1946
|
+
@_builtins.property
|
|
1947
1947
|
@pulumi.getter(name="bucketRebuildMemoryHint")
|
|
1948
|
-
def bucket_rebuild_memory_hint(self) -> pulumi.Output[
|
|
1948
|
+
def bucket_rebuild_memory_hint(self) -> pulumi.Output[_builtins.str]:
|
|
1949
1949
|
"""
|
|
1950
1950
|
Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
|
|
1951
1951
|
<be>Caution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.
|
|
@@ -1957,17 +1957,17 @@ class Indexes(pulumi.CustomResource):
|
|
|
1957
1957
|
"""
|
|
1958
1958
|
return pulumi.get(self, "bucket_rebuild_memory_hint")
|
|
1959
1959
|
|
|
1960
|
-
@property
|
|
1960
|
+
@_builtins.property
|
|
1961
1961
|
@pulumi.getter(name="coldPath")
|
|
1962
|
-
def cold_path(self) -> pulumi.Output[
|
|
1962
|
+
def cold_path(self) -> pulumi.Output[_builtins.str]:
|
|
1963
1963
|
"""
|
|
1964
1964
|
An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.
|
|
1965
1965
|
"""
|
|
1966
1966
|
return pulumi.get(self, "cold_path")
|
|
1967
1967
|
|
|
1968
|
-
@property
|
|
1968
|
+
@_builtins.property
|
|
1969
1969
|
@pulumi.getter(name="coldToFrozenDir")
|
|
1970
|
-
def cold_to_frozen_dir(self) -> pulumi.Output[
|
|
1970
|
+
def cold_to_frozen_dir(self) -> pulumi.Output[_builtins.str]:
|
|
1971
1971
|
"""
|
|
1972
1972
|
Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.
|
|
1973
1973
|
<br>
|
|
@@ -1980,9 +1980,9 @@ class Indexes(pulumi.CustomResource):
|
|
|
1980
1980
|
"""
|
|
1981
1981
|
return pulumi.get(self, "cold_to_frozen_dir")
|
|
1982
1982
|
|
|
1983
|
-
@property
|
|
1983
|
+
@_builtins.property
|
|
1984
1984
|
@pulumi.getter(name="coldToFrozenScript")
|
|
1985
|
-
def cold_to_frozen_script(self) -> pulumi.Output[
|
|
1985
|
+
def cold_to_frozen_script(self) -> pulumi.Output[_builtins.str]:
|
|
1986
1986
|
"""
|
|
1987
1987
|
Path to the archiving script.
|
|
1988
1988
|
<br>If your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.
|
|
@@ -1991,43 +1991,43 @@ class Indexes(pulumi.CustomResource):
|
|
|
1991
1991
|
"""
|
|
1992
1992
|
return pulumi.get(self, "cold_to_frozen_script")
|
|
1993
1993
|
|
|
1994
|
-
@property
|
|
1994
|
+
@_builtins.property
|
|
1995
1995
|
@pulumi.getter(name="compressRawdata")
|
|
1996
|
-
def compress_rawdata(self) -> pulumi.Output[
|
|
1996
|
+
def compress_rawdata(self) -> pulumi.Output[_builtins.bool]:
|
|
1997
1997
|
"""
|
|
1998
1998
|
This parameter is ignored. The splunkd process always compresses raw data.
|
|
1999
1999
|
"""
|
|
2000
2000
|
return pulumi.get(self, "compress_rawdata")
|
|
2001
2001
|
|
|
2002
|
-
@property
|
|
2002
|
+
@_builtins.property
|
|
2003
2003
|
@pulumi.getter
|
|
2004
|
-
def datatype(self) -> pulumi.Output[
|
|
2004
|
+
def datatype(self) -> pulumi.Output[_builtins.str]:
|
|
2005
2005
|
"""
|
|
2006
2006
|
Valid values: (event | metric). Specifies the type of index.
|
|
2007
2007
|
"""
|
|
2008
2008
|
return pulumi.get(self, "datatype")
|
|
2009
2009
|
|
|
2010
|
-
@property
|
|
2010
|
+
@_builtins.property
|
|
2011
2011
|
@pulumi.getter(name="enableOnlineBucketRepair")
|
|
2012
|
-
def enable_online_bucket_repair(self) -> pulumi.Output[
|
|
2012
|
+
def enable_online_bucket_repair(self) -> pulumi.Output[_builtins.bool]:
|
|
2013
2013
|
"""
|
|
2014
2014
|
Enables asynchronous "online fsck" bucket repair, which runs concurrently with Splunk software.
|
|
2015
2015
|
When enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.
|
|
2016
2016
|
"""
|
|
2017
2017
|
return pulumi.get(self, "enable_online_bucket_repair")
|
|
2018
2018
|
|
|
2019
|
-
@property
|
|
2019
|
+
@_builtins.property
|
|
2020
2020
|
@pulumi.getter(name="frozenTimePeriodInSecs")
|
|
2021
|
-
def frozen_time_period_in_secs(self) -> pulumi.Output[
|
|
2021
|
+
def frozen_time_period_in_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2022
2022
|
"""
|
|
2023
2023
|
Number of seconds after which indexed data rolls to frozen.
|
|
2024
2024
|
Defaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.
|
|
2025
2025
|
"""
|
|
2026
2026
|
return pulumi.get(self, "frozen_time_period_in_secs")
|
|
2027
2027
|
|
|
2028
|
-
@property
|
|
2028
|
+
@_builtins.property
|
|
2029
2029
|
@pulumi.getter(name="homePath")
|
|
2030
|
-
def home_path(self) -> pulumi.Output[
|
|
2030
|
+
def home_path(self) -> pulumi.Output[_builtins.str]:
|
|
2031
2031
|
"""
|
|
2032
2032
|
An absolute path that contains the hot and warm buckets for the index.
|
|
2033
2033
|
Required. Splunk software does not start if an index lacks a valid homePath.
|
|
@@ -2035,77 +2035,77 @@ class Indexes(pulumi.CustomResource):
|
|
|
2035
2035
|
"""
|
|
2036
2036
|
return pulumi.get(self, "home_path")
|
|
2037
2037
|
|
|
2038
|
-
@property
|
|
2038
|
+
@_builtins.property
|
|
2039
2039
|
@pulumi.getter(name="maxBloomBackfillBucketAge")
|
|
2040
|
-
def max_bloom_backfill_bucket_age(self) -> pulumi.Output[
|
|
2040
|
+
def max_bloom_backfill_bucket_age(self) -> pulumi.Output[_builtins.str]:
|
|
2041
2041
|
"""
|
|
2042
2042
|
Valid values are: Integer[m|s|h|d].
|
|
2043
2043
|
<br>If a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
|
|
2044
2044
|
"""
|
|
2045
2045
|
return pulumi.get(self, "max_bloom_backfill_bucket_age")
|
|
2046
2046
|
|
|
2047
|
-
@property
|
|
2047
|
+
@_builtins.property
|
|
2048
2048
|
@pulumi.getter(name="maxConcurrentOptimizes")
|
|
2049
|
-
def max_concurrent_optimizes(self) -> pulumi.Output[
|
|
2049
|
+
def max_concurrent_optimizes(self) -> pulumi.Output[_builtins.int]:
|
|
2050
2050
|
"""
|
|
2051
2051
|
The number of concurrent optimize processes that can run against a hot bucket.
|
|
2052
2052
|
This number should be increased if instructed by Splunk Support. Typically the default value should suffice.
|
|
2053
2053
|
"""
|
|
2054
2054
|
return pulumi.get(self, "max_concurrent_optimizes")
|
|
2055
2055
|
|
|
2056
|
-
@property
|
|
2056
|
+
@_builtins.property
|
|
2057
2057
|
@pulumi.getter(name="maxDataSize")
|
|
2058
|
-
def max_data_size(self) -> pulumi.Output[
|
|
2058
|
+
def max_data_size(self) -> pulumi.Output[_builtins.str]:
|
|
2059
2059
|
"""
|
|
2060
2060
|
The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying "auto" or "auto_high_volume" causes Splunk software to autotune this parameter (recommended).
|
|
2061
2061
|
Use "auto_high_volume" for high volume indexes (such as the main index); otherwise, use "auto". A "high volume index" would typically be considered one that gets over 10GB of data per day.
|
|
2062
2062
|
"""
|
|
2063
2063
|
return pulumi.get(self, "max_data_size")
|
|
2064
2064
|
|
|
2065
|
-
@property
|
|
2065
|
+
@_builtins.property
|
|
2066
2066
|
@pulumi.getter(name="maxHotBuckets")
|
|
2067
|
-
def max_hot_buckets(self) -> pulumi.Output[
|
|
2067
|
+
def max_hot_buckets(self) -> pulumi.Output[_builtins.int]:
|
|
2068
2068
|
"""
|
|
2069
2069
|
Maximum hot buckets that can exist per index. Defaults to 3.
|
|
2070
2070
|
<br>When maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.
|
|
2071
2071
|
"""
|
|
2072
2072
|
return pulumi.get(self, "max_hot_buckets")
|
|
2073
2073
|
|
|
2074
|
-
@property
|
|
2074
|
+
@_builtins.property
|
|
2075
2075
|
@pulumi.getter(name="maxHotIdleSecs")
|
|
2076
|
-
def max_hot_idle_secs(self) -> pulumi.Output[
|
|
2076
|
+
def max_hot_idle_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2077
2077
|
"""
|
|
2078
2078
|
Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).
|
|
2079
2079
|
"""
|
|
2080
2080
|
return pulumi.get(self, "max_hot_idle_secs")
|
|
2081
2081
|
|
|
2082
|
-
@property
|
|
2082
|
+
@_builtins.property
|
|
2083
2083
|
@pulumi.getter(name="maxHotSpanSecs")
|
|
2084
|
-
def max_hot_span_secs(self) -> pulumi.Output[
|
|
2084
|
+
def max_hot_span_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2085
2085
|
"""
|
|
2086
2086
|
Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).
|
|
2087
2087
|
"""
|
|
2088
2088
|
return pulumi.get(self, "max_hot_span_secs")
|
|
2089
2089
|
|
|
2090
|
-
@property
|
|
2090
|
+
@_builtins.property
|
|
2091
2091
|
@pulumi.getter(name="maxMemMb")
|
|
2092
|
-
def max_mem_mb(self) -> pulumi.Output[
|
|
2092
|
+
def max_mem_mb(self) -> pulumi.Output[_builtins.int]:
|
|
2093
2093
|
"""
|
|
2094
2094
|
The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.
|
|
2095
2095
|
"""
|
|
2096
2096
|
return pulumi.get(self, "max_mem_mb")
|
|
2097
2097
|
|
|
2098
|
-
@property
|
|
2098
|
+
@_builtins.property
|
|
2099
2099
|
@pulumi.getter(name="maxMetaEntries")
|
|
2100
|
-
def max_meta_entries(self) -> pulumi.Output[
|
|
2100
|
+
def max_meta_entries(self) -> pulumi.Output[_builtins.int]:
|
|
2101
2101
|
"""
|
|
2102
2102
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.
|
|
2103
2103
|
"""
|
|
2104
2104
|
return pulumi.get(self, "max_meta_entries")
|
|
2105
2105
|
|
|
2106
|
-
@property
|
|
2106
|
+
@_builtins.property
|
|
2107
2107
|
@pulumi.getter(name="maxTimeUnreplicatedNoAcks")
|
|
2108
|
-
def max_time_unreplicated_no_acks(self) -> pulumi.Output[
|
|
2108
|
+
def max_time_unreplicated_no_acks(self) -> pulumi.Output[_builtins.int]:
|
|
2109
2109
|
"""
|
|
2110
2110
|
Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.
|
|
2111
2111
|
If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.
|
|
@@ -2113,9 +2113,9 @@ class Indexes(pulumi.CustomResource):
|
|
|
2113
2113
|
"""
|
|
2114
2114
|
return pulumi.get(self, "max_time_unreplicated_no_acks")
|
|
2115
2115
|
|
|
2116
|
-
@property
|
|
2116
|
+
@_builtins.property
|
|
2117
2117
|
@pulumi.getter(name="maxTimeUnreplicatedWithAcks")
|
|
2118
|
-
def max_time_unreplicated_with_acks(self) -> pulumi.Output[
|
|
2118
|
+
def max_time_unreplicated_with_acks(self) -> pulumi.Output[_builtins.int]:
|
|
2119
2119
|
"""
|
|
2120
2120
|
Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
|
|
2121
2121
|
Note: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.
|
|
@@ -2123,25 +2123,25 @@ class Indexes(pulumi.CustomResource):
|
|
|
2123
2123
|
"""
|
|
2124
2124
|
return pulumi.get(self, "max_time_unreplicated_with_acks")
|
|
2125
2125
|
|
|
2126
|
-
@property
|
|
2126
|
+
@_builtins.property
|
|
2127
2127
|
@pulumi.getter(name="maxTotalDataSizeMb")
|
|
2128
|
-
def max_total_data_size_mb(self) -> pulumi.Output[
|
|
2128
|
+
def max_total_data_size_mb(self) -> pulumi.Output[_builtins.int]:
|
|
2129
2129
|
"""
|
|
2130
2130
|
The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
|
|
2131
2131
|
"""
|
|
2132
2132
|
return pulumi.get(self, "max_total_data_size_mb")
|
|
2133
2133
|
|
|
2134
|
-
@property
|
|
2134
|
+
@_builtins.property
|
|
2135
2135
|
@pulumi.getter(name="maxWarmDbCount")
|
|
2136
|
-
def max_warm_db_count(self) -> pulumi.Output[
|
|
2136
|
+
def max_warm_db_count(self) -> pulumi.Output[_builtins.int]:
|
|
2137
2137
|
"""
|
|
2138
2138
|
The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
|
|
2139
2139
|
"""
|
|
2140
2140
|
return pulumi.get(self, "max_warm_db_count")
|
|
2141
2141
|
|
|
2142
|
-
@property
|
|
2142
|
+
@_builtins.property
|
|
2143
2143
|
@pulumi.getter(name="minRawFileSyncSecs")
|
|
2144
|
-
def min_raw_file_sync_secs(self) -> pulumi.Output[
|
|
2144
|
+
def min_raw_file_sync_secs(self) -> pulumi.Output[_builtins.str]:
|
|
2145
2145
|
"""
|
|
2146
2146
|
Specify an integer (or "disable") for this parameter.
|
|
2147
2147
|
This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
|
|
@@ -2150,25 +2150,25 @@ class Indexes(pulumi.CustomResource):
|
|
|
2150
2150
|
"""
|
|
2151
2151
|
return pulumi.get(self, "min_raw_file_sync_secs")
|
|
2152
2152
|
|
|
2153
|
-
@property
|
|
2153
|
+
@_builtins.property
|
|
2154
2154
|
@pulumi.getter(name="minStreamGroupQueueSize")
|
|
2155
|
-
def min_stream_group_queue_size(self) -> pulumi.Output[
|
|
2155
|
+
def min_stream_group_queue_size(self) -> pulumi.Output[_builtins.int]:
|
|
2156
2156
|
"""
|
|
2157
2157
|
Minimum size of the queue that stores events in memory before committing them to a tsidx file.
|
|
2158
2158
|
"""
|
|
2159
2159
|
return pulumi.get(self, "min_stream_group_queue_size")
|
|
2160
2160
|
|
|
2161
|
-
@property
|
|
2161
|
+
@_builtins.property
|
|
2162
2162
|
@pulumi.getter
|
|
2163
|
-
def name(self) -> pulumi.Output[
|
|
2163
|
+
def name(self) -> pulumi.Output[_builtins.str]:
|
|
2164
2164
|
"""
|
|
2165
2165
|
The name of the index to create.
|
|
2166
2166
|
"""
|
|
2167
2167
|
return pulumi.get(self, "name")
|
|
2168
2168
|
|
|
2169
|
-
@property
|
|
2169
|
+
@_builtins.property
|
|
2170
2170
|
@pulumi.getter(name="partialServiceMetaPeriod")
|
|
2171
|
-
def partial_service_meta_period(self) -> pulumi.Output[
|
|
2171
|
+
def partial_service_meta_period(self) -> pulumi.Output[_builtins.int]:
|
|
2172
2172
|
"""
|
|
2173
2173
|
Related to serviceMetaPeriod. If set, it enables metadata sync every <integer> seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.
|
|
2174
2174
|
partialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.
|
|
@@ -2177,9 +2177,9 @@ class Indexes(pulumi.CustomResource):
|
|
|
2177
2177
|
"""
|
|
2178
2178
|
return pulumi.get(self, "partial_service_meta_period")
|
|
2179
2179
|
|
|
2180
|
-
@property
|
|
2180
|
+
@_builtins.property
|
|
2181
2181
|
@pulumi.getter(name="processTrackerServiceInterval")
|
|
2182
|
-
def process_tracker_service_interval(self) -> pulumi.Output[
|
|
2182
|
+
def process_tracker_service_interval(self) -> pulumi.Output[_builtins.int]:
|
|
2183
2183
|
"""
|
|
2184
2184
|
Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.
|
|
2185
2185
|
If set to 0, the indexer checks child process status every second.
|
|
@@ -2187,34 +2187,34 @@ class Indexes(pulumi.CustomResource):
|
|
|
2187
2187
|
"""
|
|
2188
2188
|
return pulumi.get(self, "process_tracker_service_interval")
|
|
2189
2189
|
|
|
2190
|
-
@property
|
|
2190
|
+
@_builtins.property
|
|
2191
2191
|
@pulumi.getter(name="quarantineFutureSecs")
|
|
2192
|
-
def quarantine_future_secs(self) -> pulumi.Output[
|
|
2192
|
+
def quarantine_future_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2193
2193
|
"""
|
|
2194
2194
|
Events with timestamp of quarantineFutureSecs newer than "now" are dropped into quarantine bucket. Defaults to 2592000 (30 days).
|
|
2195
2195
|
This is a mechanism to prevent main hot buckets from being polluted with fringe events.
|
|
2196
2196
|
"""
|
|
2197
2197
|
return pulumi.get(self, "quarantine_future_secs")
|
|
2198
2198
|
|
|
2199
|
-
@property
|
|
2199
|
+
@_builtins.property
|
|
2200
2200
|
@pulumi.getter(name="quarantinePastSecs")
|
|
2201
|
-
def quarantine_past_secs(self) -> pulumi.Output[
|
|
2201
|
+
def quarantine_past_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2202
2202
|
"""
|
|
2203
2203
|
Events with timestamp of quarantinePastSecs older than "now" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.
|
|
2204
2204
|
"""
|
|
2205
2205
|
return pulumi.get(self, "quarantine_past_secs")
|
|
2206
2206
|
|
|
2207
|
-
@property
|
|
2207
|
+
@_builtins.property
|
|
2208
2208
|
@pulumi.getter(name="rawChunkSizeBytes")
|
|
2209
|
-
def raw_chunk_size_bytes(self) -> pulumi.Output[
|
|
2209
|
+
def raw_chunk_size_bytes(self) -> pulumi.Output[_builtins.int]:
|
|
2210
2210
|
"""
|
|
2211
2211
|
Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
|
|
2212
2212
|
"""
|
|
2213
2213
|
return pulumi.get(self, "raw_chunk_size_bytes")
|
|
2214
2214
|
|
|
2215
|
-
@property
|
|
2215
|
+
@_builtins.property
|
|
2216
2216
|
@pulumi.getter(name="repFactor")
|
|
2217
|
-
def rep_factor(self) -> pulumi.Output[
|
|
2217
|
+
def rep_factor(self) -> pulumi.Output[_builtins.str]:
|
|
2218
2218
|
"""
|
|
2219
2219
|
Index replication control. This parameter applies to only clustering slaves.
|
|
2220
2220
|
auto = Use the master index replication configuration value.
|
|
@@ -2222,34 +2222,34 @@ class Indexes(pulumi.CustomResource):
|
|
|
2222
2222
|
"""
|
|
2223
2223
|
return pulumi.get(self, "rep_factor")
|
|
2224
2224
|
|
|
2225
|
-
@property
|
|
2225
|
+
@_builtins.property
|
|
2226
2226
|
@pulumi.getter(name="rotatePeriodInSecs")
|
|
2227
|
-
def rotate_period_in_secs(self) -> pulumi.Output[
|
|
2227
|
+
def rotate_period_in_secs(self) -> pulumi.Output[_builtins.int]:
|
|
2228
2228
|
"""
|
|
2229
2229
|
How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
|
|
2230
2230
|
"""
|
|
2231
2231
|
return pulumi.get(self, "rotate_period_in_secs")
|
|
2232
2232
|
|
|
2233
|
-
@property
|
|
2233
|
+
@_builtins.property
|
|
2234
2234
|
@pulumi.getter(name="serviceMetaPeriod")
|
|
2235
|
-
def service_meta_period(self) -> pulumi.Output[
|
|
2235
|
+
def service_meta_period(self) -> pulumi.Output[_builtins.int]:
|
|
2236
2236
|
"""
|
|
2237
2237
|
Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).
|
|
2238
2238
|
You may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.
|
|
2239
2239
|
"""
|
|
2240
2240
|
return pulumi.get(self, "service_meta_period")
|
|
2241
2241
|
|
|
2242
|
-
@property
|
|
2242
|
+
@_builtins.property
|
|
2243
2243
|
@pulumi.getter(name="syncMeta")
|
|
2244
|
-
def sync_meta(self) -> pulumi.Output[
|
|
2244
|
+
def sync_meta(self) -> pulumi.Output[_builtins.bool]:
|
|
2245
2245
|
"""
|
|
2246
2246
|
When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
|
|
2247
2247
|
"""
|
|
2248
2248
|
return pulumi.get(self, "sync_meta")
|
|
2249
2249
|
|
|
2250
|
-
@property
|
|
2250
|
+
@_builtins.property
|
|
2251
2251
|
@pulumi.getter(name="thawedPath")
|
|
2252
|
-
def thawed_path(self) -> pulumi.Output[
|
|
2252
|
+
def thawed_path(self) -> pulumi.Output[_builtins.str]:
|
|
2253
2253
|
"""
|
|
2254
2254
|
An absolute path that contains the thawed (resurrected) databases for the index.
|
|
2255
2255
|
Cannot be defined in terms of a volume definition.
|
|
@@ -2257,26 +2257,26 @@ class Indexes(pulumi.CustomResource):
|
|
|
2257
2257
|
"""
|
|
2258
2258
|
return pulumi.get(self, "thawed_path")
|
|
2259
2259
|
|
|
2260
|
-
@property
|
|
2260
|
+
@_builtins.property
|
|
2261
2261
|
@pulumi.getter(name="throttleCheckPeriod")
|
|
2262
|
-
def throttle_check_period(self) -> pulumi.Output[
|
|
2262
|
+
def throttle_check_period(self) -> pulumi.Output[_builtins.int]:
|
|
2263
2263
|
"""
|
|
2264
2264
|
Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).
|
|
2265
2265
|
"""
|
|
2266
2266
|
return pulumi.get(self, "throttle_check_period")
|
|
2267
2267
|
|
|
2268
|
-
@property
|
|
2268
|
+
@_builtins.property
|
|
2269
2269
|
@pulumi.getter(name="tstatsHomePath")
|
|
2270
|
-
def tstats_home_path(self) -> pulumi.Output[
|
|
2270
|
+
def tstats_home_path(self) -> pulumi.Output[_builtins.str]:
|
|
2271
2271
|
"""
|
|
2272
2272
|
Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.
|
|
2273
2273
|
If specified, it must be defined in terms of a volume definition.
|
|
2274
2274
|
"""
|
|
2275
2275
|
return pulumi.get(self, "tstats_home_path")
|
|
2276
2276
|
|
|
2277
|
-
@property
|
|
2277
|
+
@_builtins.property
|
|
2278
2278
|
@pulumi.getter(name="warmToColdScript")
|
|
2279
|
-
def warm_to_cold_script(self) -> pulumi.Output[
|
|
2279
|
+
def warm_to_cold_script(self) -> pulumi.Output[_builtins.str]:
|
|
2280
2280
|
"""
|
|
2281
2281
|
Path to a script to run when moving data from warm to cold.
|
|
2282
2282
|
This attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.
|