Forums: SplunkAdministration: New Indexes Options

When creating a new index "#$SPLUNK_HOME/bin/splunk add index <name>
You are asked these three questions and given these defaults:

add database called
Please enter the max data size in MBs (40)

Please enter the max warm db count (100)

Please enter the frozen time out period in secs (188697600)

Please enter the max total data size in MBs (40000)

I have read the indexes.conf.spec file to find out what these options are, but have some questions:

maxDataSize = <non-negative number> (750)
* The number of MB's db hot is allowed to grow to before it is rolled out to warm.
This number should not be increased unless Splunk is running in 64bit mode.
Should I leave the default value of 40 or use 750? Is there any reference to what this number should be?

maxWarmDBCount = <non-negative number> (300)
* The maximum number of db_N_N_N directories that will be in the warm db state. All warm dbs will be in the <homePath> for the index and splunk will maintain these directories in the open state.**
Should I leave the default value of 100 or use 300? Is there any reference to what this number should be?

Are there any other values I need to worry about for my new index located in the indexes.conf file?

I think you should go ahead and use the values from indexes.conf rather than the suggested defaults from "add index". I will check and see if the CLI needs to be updated.

Yup you want to use the values in the default indexes.conf.

The defaults for splunk add index will be updated in an upcoming release