https://community.splunk.com/t5/Splunk-Enterprise/Cold-rolling-to-frozen-when-it-shouldn-t/m-p/75522#M8858 <P>Support walked through a bunch of troubleshooting on this, only to find.... my syslog nightly maintenance script had a careless find command that included the Splunk Cold DB. That script was removing files every night. ARRG!</P> <P>Thanks Splunk support dudes, Josh and Octavio, for being patient and helpful.</P> Fri, 29 Apr 2011 19:51:02 GMT twinspop 2011-04-29T19:51:02Z https://community.splunk.com/t5/Splunk-Enterprise/Cold-rolling-to-frozen-when-it-shouldn-t/m-p/75521#M8857 <P>My $SPLUNK_HOME/etc/system/local/indexes.conf is below. Apparently I'm missing something because cold archives are being dumped even though cold storage is currently only at 2 GB and /opt/splunk/var/lib/splunk/defaultdb is at 11 GB. Shouldn't maxTotalDataSizeMB and frozenTimePeriodInSecs be determining when cold storage rolls to frozen? Why is it being ignored?</P> <PRE><CODE>[default] maxTotalDataSizeMB = 10000 [main] coldPath = /syslog/splunk_archives maxTotalDataSizeMB = 150000 maxHotBuckets = 10 maxDataSize = 500 # most warm buckets we can have is 30 =~ 15 GB maxWarmDBCount = 30 # roll cold to frozen after 1 year frozenTimePeriodInSecs = 31536000 # for summary index [lgn-stats] homePath = $SPLUNK_DB/lgn-stats/db thawedPath = $SPLUNK_DB/lgn-stats/thaweddb coldPath = $SPLUNK_DB/lgn-stats/colddb maxTotalDataSizeMB = 1000 </CODE></PRE> <P>I've promised the pointy-haired boss types we'd have at least 90 days of logs available, if not much more. I have 29 days and a LOT of empty disk space. Doh!</P> <P>Thanks, jon</P> Wed, 06 Apr 2011 21:28:17 GMT https://community.splunk.com/t5/Splunk-Enterprise/Cold-rolling-to-frozen-when-it-shouldn-t/m-p/75521#M8857 twinspop 2011-04-06T21:28:17Z https://community.splunk.com/t5/Splunk-Enterprise/Cold-rolling-to-frozen-when-it-shouldn-t/m-p/75522#M8858 <P>Support walked through a bunch of troubleshooting on this, only to find.... my syslog nightly maintenance script had a careless find command that included the Splunk Cold DB. That script was removing files every night. ARRG!</P> <P>Thanks Splunk support dudes, Josh and Octavio, for being patient and helpful.</P> Fri, 29 Apr 2011 19:51:02 GMT https://community.splunk.com/t5/Splunk-Enterprise/Cold-rolling-to-frozen-when-it-shouldn-t/m-p/75522#M8858 twinspop 2011-04-29T19:51:02Z