topic Re: Splunk Buckets in Getting Data In

Splunk Buckets

vikramyadav — Mon, 16 Aug 2021 08:59:31 GMT

Hi,

I have one index(test0) in a standalone server. I'm trying to make
3-month data searchable
after 6 months of data to Archive
And after 12 months of data to delete/retention

Below is my config
[test0]
coldPath = $SPLUNK_DB/test0/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test0/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/test0/thaweddb
maxDataSize = 750
maxWarmDBCount = 500
frozenTimePeriodInSecs = 31556926
coldToFrozenDir = /opt/backup/index

Is above configuration is correct ?

Re: Splunk Buckets

scelikok — Mon, 16 Aug 2021 10:35:41 GMT

Hi @vikramyadav,

Splunk does not manage archived data. With your configuration indexed data will be moved to the archive folder (/opt/backup/index) after one year. The last one-year data will be searchable if your maxTotalDataSizeMB value is enough. If index size exceeds this 512 GB it will be moved to the archive folder.

You can set frozenTimePeriodInSec value to 15552000, in order to archive after 6 months. Also you should calculate 6 months data size to set maxTotalDataSizeMB value.

You have to manually manage archived data with custom script etc for 12 months.