topic Re: Archiving frozen data to network drive in Splunk Dev

Archiving frozen data to network drive

sudhir7 — Wed, 09 Jan 2019 05:02:20 GMT

I am trying to archive data to the network drive, I have following stanza in my indexes.conf file.

[indexName]
frozenTimePeriodInSecs = 31622400
coldToFrozenDir = \\netwotkDrive\splunk\indexName\frozendb

This setting is not working for me.
Has anyone else faced a similar situation? Are there any configurational settings I am missing?

Re: Archiving frozen data to network drive

dkeck — Wed, 09 Jan 2019 07:25:33 GMT

Hi,

did you restart after changing this?

Re: Archiving frozen data to network drive

sudhir7 — Wed, 09 Jan 2019 08:30:55 GMT

@dkeck Yes.

Re: Archiving frozen data to network drive

suamme1 — Wed, 09 Oct 2019 20:57:55 GMT

I wasn't able to get this to work directly to a network folder as you posted. If you are still working on it, I ended up configuring a folder on each indexer that is a NTFS junction to a remote file share. This way, the splunk service writes as if it is a local file and NTFS takes care of the rest. I'm not sure if it's a supported solution, but my low-volume cluster has been running like this for several years with no apparent issues.

One thing to note with an indexer cluster is to point the junction to a different folder within the share for each machine to avoid naming collisions (IndexerA's junction should point to \server\share\indexerA and IndexerB's to \server\share\indexerB or some similar scheme).