/*
* Copyright 2013 Splunk, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License"): you may
* not use this file except in compliance with the License. You may obtain
* a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
* License for the specific language governing permissions and limitations
* under the License.
*/
namespace Splunk
{
///
/// The class extends for creation-specific properties.
///
public class IndexArgs : Args
{
///
/// Sets a value indicating whether all data retrieved from the index
/// is proper UTF8.
///
///
///
/// Note: When enabled indexing, performance will degrade.
///
///
/// This property's default value is false.
///
///
public bool AssureUTF8
{
set
{
this["assureUTF8"] = value;
}
}
///
/// Sets the block sign size for this index.
///
///
///
/// This value defines the number of events that make up a block for
/// block signatures.
///
///
/// If this property is set to "0", block signing is disabled for this
/// index.
///
///
/// This property's recommended value is "100".
///
///
/// This property's default value is "0".
///
///
public int BlockSignSize
{
set
{
this["blockSignSize"] = value;
}
}
///
/// Sets the suggested Splunk bucket rebuild process for the size of
/// the time-series (tsidx) file to make.
///
///
///
/// Caution: This is an advanced parameter. Inappropriate use
/// of this parameter causes splunkd to not start if rebuild is
/// required. Do not set this parameter unless instructed by Splunk
/// Support.
///
///
/// This property's default value is "auto".
///
///
/// This property is available starting in Splunk 5.0.
///
///
public string BucketRebuildMemoryHint
{
set
{
this["BucketRebuildMemoryHint"] = value;
}
}
///
/// Sets an absolute filesystem path, local to the server, to
/// the cold database for the index. The path must be both readable and
/// writable.
///
///
///
/// Cold databases are opened as needed when searching. May be
/// defined in terms of a volume definition (see volume).
///
///
/// This property's value may contain shell expansion terms.
///
///
/// Be aware that Splunk will not start if an index lacks a valid
/// .
///
///
public string ColdPath
{
set
{
this["coldPath"] = value;
}
}
///
/// Sets the destination filesystem path, local to the server, for the
/// frozen archive. Splunk automatically puts frozen buckets in this
/// directory.
///
///
///
/// Use as an alternative to a .
///
///
/// Bucket freezing policy is as follows:
///
///
/// -
/// New style buckets (4.2 and on): removes all files but the rawdata.
/// To thaw, run splunk rebuild "bucket dir" on the bucket, then move to
/// the thawed directory.
///
/// -
/// Old style buckets (Pre-4.2): gzip all the
/// .data and .tsidx files. To thaw, gunzip the zipped files and move
/// the bucket into the thawed directory for that index.
///
///
///
/// Note: If both the
/// and properties are specified, the
/// property takes precedence.
///
///
public string ColdToFrozenDir
{
set
{
this["coldToFrozenDir"] = value;
}
}
///
/// Sets the filesystem path, local to the server, that is the archiving
/// script.
///
///
///
/// Bucket freezing policy is as follows:
///
///
/// -
/// New style buckets (4.2 and on): removes all files but the rawdata.
/// To thaw, run splunk rebuild "bucket dir" on the bucket, then move to
/// the thawed directory. Use the unless
/// you need to perform a more advanced operation upon freezing buckets.
///
/// -
/// Old style buckets (Pre-4.2): gzip all the
/// .data and .tsidx files. To thaw, gunzip the zipped files and move
/// the bucket into the thawed directory for that index.
///
///
///
public string ColdToFrozenScript
{
set
{
this["coldToFrozenScript"] = value;
}
}
///
/// Sets a value indicating whether asynchronous (online fsck) bucket
/// repair is enabled. When enabled, bucket repair runs concurrently
/// with Splunk.
///
///
///
/// When this feature is enabled, you don't have to wait for buckets
/// to be repaired before starting Splunk, but you might notice a
/// slight degradation in performance as a result.
///
///
/// This property's default value is "enabled".
///
///
public bool EnableOnlineBucketRepair
{
set
{
this["enableOnlineBucketRepair"] = value;
}
}
///
/// Sets the number of seconds after which indexed data rolls to frozen.
///
///
///
/// Freezing data means it is removed from the index.
/// If archiving is necessary for frozen data, see the ColdToFrozen
/// attributes, and
/// .
///
///
/// This property's default value is "188697600" (6 years).
///
///
///
///
public int FrozenTimePeriodInSecs
{
set
{
this["frozenTimePeriodInSecs"] = value;
}
}
///
/// Sets an absolute path that contains the hot and warm buckets for the
/// index. The path must be both readable and writable.
///
///
///
/// This property's value may contain shell expansion terms.
///
///
/// Note: Splunk will not start if an index lacks a valid
/// .
///
///
public string HomePath
{
set
{
this["homePath"] = value;
}
}
///
/// Sets a time that indicates a bucket age. When a warm or
/// cold bucket is older than this, Splunk does not create or rebuild
/// its bloomfilter.
///
///
///
/// The valid format is number followed by a time unit ("s",
/// "m", "h", or "d"). For example, "30d" indicates 30 days.
///
///
/// When this property is set to "0", Splunk never rebuilds
/// bloom filters.
///
///
/// This property's default value is "30d".
///
///
public string MaxBloomBackfillBucketAge
{
set
{
this["maxBloomBackfillBucketAge"] = value;
}
}
///
/// Sets the maximum number of concurrent optimize processes
/// that can run against a hot bucket for this index.
///
///
///
/// This number should be increased from the
/// default only if instructed by Splunk Support.
///
///
/// This property's default value is "3".
///
///
public int MaxConcurrentOptimizes
{
set
{
this["maxConcurrentOptimizes"] = value;
}
}
///
/// Sets the maximum size in megabytes (MB) for a hot database to reach
/// before triggering a roll from hot to warm buckets for this index.
///
///
///
/// Acceptable values are also "auto" or "auto_high_volume".
///
///
/// - "auto" sets the size to 750MB
/// - "auto_high_volume" sets the size to 10 gigabytes (GB) on
/// 64-bit, and 1GB on 32-bit systems
///
///
/// A "high volume index" would typically be considered one that gets
/// over 10GB of data per day.
///
///
/// Although the maximum value to which you can set this property is
/// 1048576MB, which corresponds to 1 terabyte (TB), a reasonable
/// number ranges anywhere from 100 to 50000. Any number outside this
/// range should be approved by Splunk Support before proceeding.
///
///
/// If you specify an invalid number or string, will be auto tuned.
///
///
/// Note: The precise size of your warm buckets may
/// vary from , due to post-processing and
/// timing issues with the rolling policy.
///
///
/// This property's default value is "auto".
///
///
public string MaxDataSize
{
set
{
this["maxDataSize"] = value;
}
}
///
/// Sets the maximum number of hot buckets for this index.
///
///
///
/// When is exceeded, Splunk rolls the
/// least recently used (LRU) hot bucket to warm. Both normal hot
/// buckets and quarantined hot buckets count towards this total.
/// This setting operates independently of , which can also cause hot buckets to roll.
///
///
/// This property's default value is "3".
///
///
public int MaxHotBuckets
{
set
{
this["maxHotBuckets"] = value;
}
}
///
/// Sets the maximum life of a hot bucket, in seconds.
///
///
/// If a hot bucket exceeds this property's value, Splunk rolls
/// the bucket to warm. This setting operates independently of , which can also cause hot buckets to roll.
///
/// A value of "0" turns off the idle check, and indicates an
/// infinite lifetime.
///
///
/// This property's default value is "0".
///
///
public int MaxHotIdleSecs
{
set
{
this["maxHotIdleSecs"] = value;
}
}
///
/// Sets the upper bound of target maximum timespan of hot and warm
/// buckets for this index, in seconds.
///
///
///
/// Note: If you set this property too small, you can get an
/// explosion of hot/warm buckets in the filesystem. The system sets
/// a lower bound implicitly for this parameter at 3600, but this is an
/// advanced parameter that should be set with care and understanding
/// of the characteristics of your data.
///
///
/// This property's default value is "7776000" (90 days).
///
///
public int MaxHotSpanSecs
{
set
{
this["maxHotSpanSecs"] = value;
}
}
///
/// Sets the amount of memory, expressed in megabytes (MB), to
/// allocate for buffering a single tsidx file into memory before
/// flushing to disk.
///
///
///
/// This property's default value ("5") is recommended for all
/// environments.
///
///
/// Important: Calculate this number carefully. Setting this
/// number incorrectly may have adverse effects on your system's memory
/// and splunkd stability and performance.
///
///
/// This property's default value is "5".
///
///
public int MaxMemMB
{
set
{
this["maxMemMB"] = value;
}
}
///
/// Sets the maximum number of unique lines in .data files in a bucket,
/// which may help to reduce memory consumption.
///
///
///
/// If set to "0", this setting is ignored (it is treated as
/// infinite).
///
///
/// If this property's value is exceeded, a hot bucket is rolled to
/// prevent further increase. If your buckets are rolling due to
/// Strings.data hitting this limit, the culprit may be the punct field
/// in your data. If you don't use punct, it may be best to simply
/// disable this (see props.conf.spec in
/// $SPLUNK_HOME/etc/system/README). There is a small time delta
/// between when maximum is exceeded and bucket is rolled. This means
/// a bucket may end up with epsilon more lines than specified, but
/// this is not a major concern unless the excess is significant.
///
///
/// This property's default value is "1000000".
///
///
public int MaxMetaEntries
{
set
{
this["maxMetaEntries"] = value;
}
}
///
/// Sets the maximum size of an index, in megabytes (MB).
///
///
///
/// If an index grows larger than the maximum size, the oldest data is
/// frozen.
///
///
/// This property's default value is "500000".
///
///
public int MaxTotalDataSizeMB
{
set
{
this["maxTotalDataSizeMB"] = value;
}
}
///
/// Sets the upper limit, in seconds, on how long an event can sit in
/// raw slice.
///
///
///
/// This property applies only if replication is enabled for this
/// index; otherwise it is ignored.
///
///
/// If there are any acknowledged events sharing this raw slice, this
/// property does not apply.
///
///
/// This property's highest legal value is "2147483647".
///
///
/// To disable this property, set it to "0".
///
///
/// Note: This is an advanced property. Understand the
/// consequences before changing it.
///
///
/// This property is available starting in Splunk 5.0.
///
///
public int MaxTimeUnreplicatedNoAcks
{
set
{
this["MaxTimeUnreplicatedNoAcks"] = value;
}
}
///
/// Sets the maximum number of warm buckets for this index.
///
///
///
/// If this property's value is exceeded, the warm buckets with the
/// lowest value for their latest times are moved to cold.
///
///
/// This property's default value is "300".
///
///
public int MaxWarmDBCount
{
set
{
this["maxWarmDBCount"] = value;
}
}
///
/// Sets how frequently splunkd forces a filesystem sync while
/// compressing journal slices.
///
///
///
/// During the interval specified by this property, uncompressed
/// slices are left on disk even after they are compressed. Then
/// splunkd forces a filesystem sync of the compressed journal and
/// removes the accumulated uncompressed files.
///
///
/// If this property is set to "0", splunkd forces a filesystem sync
/// after every slice completes compressing.
///
///
/// If this property is set to "disable", syncing is disabled entirely;
/// uncompressed slices are removed as soon as compression is complete.
///
///
/// Note: Some filesystems are very inefficient at performing
/// sync operations, so only enable this if you are sure it is needed.
///
///
/// This property's default value is "disable".
///
///
public string MinRawFileSyncSecs
{
set
{
this["minRawFileSyncSecs"] = value;
}
}
///
/// Gets or sets the frequency, in seconds, at which metadata is
/// partially synced (synced in-place) for this index.
///
///
///
/// If set, this property's value indicates the frequency at which
/// metadata is synchronized, but only for records where the sync can
/// be done efficiently in place, without requiring a full rewrite of
/// the metadata file. Records that require a full rewrite are
/// synchronized at an interval defined by the property.
///
///
/// When this property is set to a value of "0", partial syncing is
/// disabled, so metadata is only synced on an interval defined by the
/// property.
///
///
/// If the value of this property is greater than that of the
/// property, then this property has no
/// effect.
///
///
/// This property's default value is "0".
///
///
public int PartialServiceMetaPeriod
{
set
{
this["partialServiceMetaPeriod"] = value;
}
}
///
/// Sets the future event-time quarantine for this index.
/// Events that are newer than now plus this value are quarantined.
///
///
/// This property's default value is "2592000" (30 days).
///
public int QuarantineFutureSecs
{
set
{
this["quarantineFutureSecs"] = value;
}
}
///
/// Sets the past event-time quarantine for this index.
/// Events that are older than now minus this value are quarantined.
///
///
/// This property's default value is "77760000" (900 days).
///
public int QuarantinePastSecs
{
set
{
this["quarantinePastSecs"] = value;
}
}
///
/// Sets the target uncompressed size of individual raw slices
/// in the raw data journal for this index.
///
///
///
/// Warning: This is an advanced property. Only change it if
/// you are instructed to do so by Splunk Support.
///
///
/// This property only specifies a target chunk size. The actual chunk
/// size may be slightly larger by an amount proportional to an
/// individual event size.
///
///
/// This property's default value is 131072 (128 kilobytes (KB)).
///
///
public int RawChunkSizeBytes
{
set
{
this["rawChunkSizeBytes"] = value;
}
}
///
/// Sets the replication factor.
///
///
///
/// Valid values for this property are either a non-negative number
/// or the "auto" keyword.
///
///
/// A value of "auto" instructs Splunk to use the value as configured
/// with the master.
///
///
/// A value of "0" turns off replication for this index.
///
///
/// This parameter only applies to Splunk clustering slaves.
///
///
/// This property is available starting in Splunk 5.0.
///
///
public string ReplicationFactor
{
set
{
this["repFactor"] = value;
}
}
///
/// Sets or sets the frequency to check for the need to create a new
/// hot bucket and the need to roll or freeze any warm or cold buckets
/// for this index.
///
public int RotatePeriodInSecs
{
set
{
this["rotatePeriodInSecs"] = value;
}
}
///
/// Sets the frequency, in seconds, at which metadata is synced to
/// disk for this index.
///
///
///
/// You may want to set this to a larger value if the sum of your
/// metadata file sizes is larger than many tens of megabytes, to
/// avoid the hit on I/O in the indexing fast path.
///
///
/// This property's default value is "25".
///
///
public int ServiceMetaPeriod
{
set
{
this["serviceMetaPeriod"] = value;
}
}
///
/// Sets a value indicating whether the sync
/// operation is invoked before the file descriptor is closed on
/// metadata updates.
///
///
///
/// This functionality improves integrity of metadata files, especially
/// in regards to operating system crashes or machine failures.
///
///
/// Warning: This is an advanced parameter. Only change it if
/// you are instructed to do so by Splunk Support.
///
///
/// This property's default value is true.
///
///
public bool SyncMeta
{
set
{
this["syncMeta"] = value;
}
}
///
/// Sets an absolute filesystem path, local to the server, that
/// contains the thawed (resurrected) databases for the index.
///
///
///
/// Be aware that Splunk will not start if an index lacks a
/// valid .
///
///
/// This property's value may contain shell expansion terms.
///
///
public string ThawedPath
{
set
{
this["thawedPath"] = value;
}
}
///
/// Sets the frequency at which Splunk checks for an index
/// throttling condition.
///
///
///
/// This property's value should be changed from the default only
/// if instructed by Splunk Support.
///
///
/// This property's default value is "15".
///
///
public int ThrottleCheckPeriod
{
set
{
this["throttleCheckPeriod"] = value;
}
}
}
}