https://community.splunk.com/t5/Deployment-Architecture/Roll-warm-to-cold-based-on-time/m-p/532358#M18316 <P>I'm trying to configure my indexes.conf to roll all db files based on time. Hot -&gt; Warm (1 day) -&gt; Cold (2 weeks) -&gt; Frozen (6 months).&nbsp;</P><P>Now I know how to do the cold to frozen and frozen to thawed but I'm trying to figure out if I can do Hot to Warm to Cold based on time and not size.</P><P>I found references to a work around with the following set up</P><P>[main]<BR />maxHotBuckets = 3<BR />maxHotSpanSecs = 86400 (1day)<BR />maxHotIdleSecs = 86400<BR />maxWarmDBCount = 14<BR />frozenTimePeriodinSecs = 15724800 (6 months)<BR />coldToFrozenDir = &lt;path&gt;<BR />thawedPath = &lt;path&gt;</P><P>Will this work to roll buckets from hot to warm in 24 hours, then from warm to cold in 2 weeks? Does anyone see an issue with this?</P> Tue, 08 Dec 2020 16:50:11 GMT michaeler 2020-12-08T16:50:11Z https://community.splunk.com/t5/Deployment-Architecture/Roll-warm-to-cold-based-on-time/m-p/532358#M18316 <P>I'm trying to configure my indexes.conf to roll all db files based on time. Hot -&gt; Warm (1 day) -&gt; Cold (2 weeks) -&gt; Frozen (6 months).&nbsp;</P><P>Now I know how to do the cold to frozen and frozen to thawed but I'm trying to figure out if I can do Hot to Warm to Cold based on time and not size.</P><P>I found references to a work around with the following set up</P><P>[main]<BR />maxHotBuckets = 3<BR />maxHotSpanSecs = 86400 (1day)<BR />maxHotIdleSecs = 86400<BR />maxWarmDBCount = 14<BR />frozenTimePeriodinSecs = 15724800 (6 months)<BR />coldToFrozenDir = &lt;path&gt;<BR />thawedPath = &lt;path&gt;</P><P>Will this work to roll buckets from hot to warm in 24 hours, then from warm to cold in 2 weeks? Does anyone see an issue with this?</P> Tue, 08 Dec 2020 16:50:11 GMT https://community.splunk.com/t5/Deployment-Architecture/Roll-warm-to-cold-based-on-time/m-p/532358#M18316 michaeler 2020-12-08T16:50:11Z