https://community.splunk.com/t5/Deployment-Architecture/cold-path-not-exis/m-p/690127#M28262 <P>The coldPath setting must be defined and the location must exist.&nbsp; It's not possible (and not advised to try) to have a different configuration for the "DR" indexers.</P><P>To avoid using the cold path, create a script that deletes buckets and define it as the <FONT face="courier new,courier">warmToColdScript</FONT> for the index(es).&nbsp;&nbsp; You also could assign the coldPath to a volume and make that volume large enough for a single bucket so cold buckets are frozen almost immediately.</P> Sun, 09 Jun 2024 11:39:23 GMT richgalloway 2024-06-09T11:39:23Z https://community.splunk.com/t5/Deployment-Architecture/cold-path-not-exis/m-p/690125#M28260 <P>hello all,</P><P>&nbsp;</P><P>we have multi-site cluster master and&nbsp; we do not want a cold mount in the DR indexers.</P><P>is it applicable?</P><P>&nbsp;</P><P>If&nbsp; indexer&nbsp; hits hot/warm retention and not found the cold path will delete the data&nbsp; ?</P> Sun, 09 Jun 2024 11:10:25 GMT https://community.splunk.com/t5/Deployment-Architecture/cold-path-not-exis/m-p/690125#M28260 hazem 2024-06-09T11:10:25Z https://community.splunk.com/t5/Deployment-Architecture/cold-path-not-exis/m-p/690127#M28262 <P>The coldPath setting must be defined and the location must exist.&nbsp; It's not possible (and not advised to try) to have a different configuration for the "DR" indexers.</P><P>To avoid using the cold path, create a script that deletes buckets and define it as the <FONT face="courier new,courier">warmToColdScript</FONT> for the index(es).&nbsp;&nbsp; You also could assign the coldPath to a volume and make that volume large enough for a single bucket so cold buckets are frozen almost immediately.</P> Sun, 09 Jun 2024 11:39:23 GMT https://community.splunk.com/t5/Deployment-Architecture/cold-path-not-exis/m-p/690127#M28262 richgalloway 2024-06-09T11:39:23Z