According to the indexes.conf reference in Splunk Enterprise, the parameter maxDataSize controls the maximum size (in GB or MB) of a single hot bucket before Splunk rolls it to a warm bucket. When the value is set to auto_high_volume on a 64-bit system, Splunk automatically sets the maximum hot bucket size to 10 GB.
The "auto" settings allow Splunk to choose optimized values based on the system architecture:
* auto: Default hot bucket size of 750 MB (32-bit) or 10 GB (64-bit).
* auto_high_volume: Specifically tuned for high-ingest indexes; on 64-bit systems, this equals 10 GB per hot bucket.
* auto_low_volume: Uses smaller bucket sizes for lightweight indexes.
The purpose of larger hot bucket sizes on 64-bit systems is to improve indexing performance and reduce the overhead of frequent bucket rolling during heavy data ingestion. The documentation explicitly warns that these sizes differ on 32-bit systems due to memory addressing limitations.
Thus, for high-throughput environments running 64-bit operating systems, auto_high_volume = 10 GB is the correct and Splunk-documented configuration.
References (Splunk Enterprise Documentation):
* indexes.conf - maxDataSize Attribute Reference
* Managing Index Buckets and Data Retention
* Splunk Enterprise Admin Manual - Indexer Storage Configuration
* Splunk Performance Tuning: Bucket Management and Hot/Warm Transitions