topic coldToFrozenDir per index in Getting Data In

coldToFrozenDir per index

imacdonald2 — Fri, 20 Jan 2012 21:55:51 GMT

I was running a cold to frozen script that moved the forzen files into a separate directory per index.

/opt/splunk/bin/compressedExport.sh

( cd "$1" && gzip *.tsidx )
SPATH=`echo $1 |sed 's/^\/var\/splunk\/lib\/splunk\/\(.*\/\)db.*$/\1/'`
mkdir -p /var/splunk/archive/$SPATH
cp -r "$1" /var/splunk/archive/$SPATH  #replace this with your archive directory

So I would end up with the archives in
/var/splunk/archive/index1
/var/splunk/archive/index2
etc

Is there an easy way to do something similar with the new coldtofrozen script.

I tried setting
coldToFrozenDir = /var/splunk/archive/
but all the archive files end up in the root of the /var/splunk/archive/ directory.

Can I define coldToFrozenDir per index?

Re: coldToFrozenDir per index

imacdonald2 — Sat, 21 Jan 2012 00:05:19 GMT

I found the answer, I looked at the
/opt/splunk/bin/coldToFrozenExample.py script and saw it has this line at the end

destdir = os.path.join(ARCHIVE_DIR, indexname, os.path.basename(bucket))

So if I use that script it will put it in /ARCHIVE_DIR/index/

So I made a copy of the script, edited it, added a new line at the top, so on unix systems it will execute as a python script

#!/opt/splunk/bin/python

and changing the ARCHIVE_DIR line at the top to

ARCHIVE_DIR = '/var/splunk/archive'

then added the following to the [default] in /opt/splunk/etc/system/local/indexes.conf

coldToFrozenScript = $SPLUNK_HOME/bin/coldToFrozen.py

Now it archives to a folder in /var/splunk/archive/indexname/