topic Re: How do I verify that a configuration change for shortening the time to frozen has gone through? in Getting Data In

How do I verify that a configuration change for shortening the time to frozen has gone through?

wwhitener — Mon, 19 Sep 2011 21:09:41 GMT

Good afternoon,

I am trying to verify a configuration change. I've shortened the indexes.conf to make the frozenTimePeriodInSecs shorter than the default--about a week. How do I verify that the change has gone through? I've tried looking at some static log files I had indexed to test and those don't appear to have changed. I've tried indexing and looking at splunk log files (test system--nothing really is going in it) and those seem to show that the data has been pruned and cleared out. If someone knows how to veirfy and prove that this change has worked, could I please get a clue from you on how to go about it?

Thank you.

Edited to add: Our test server is 3.4.5.

Re: How do I verify that a configuration change for shortening the time to frozen has gone through?

MarioM — Tue, 20 Sep 2011 06:17:32 GMT

You should see INFO entries about BucketMover in splunkd.log:

index=_internal source="/opt/splunk/var/log/splunk/splunkd.log" component="BucketMover"

Some message similar to this:

09-20-2011 08:01:08.990 +0200 INFO  BucketMover - AsyncFreezer freeze succeeded for /opt/splunk/var/lib/splunk/defaultdb/colddb/db_1308473665_1308226506_25

Re: How do I verify that a configuration change for shortening the time to frozen has gone through?

wwhitener — Tue, 20 Sep 2011 16:32:39 GMT

I don't know if this is a matter of version or not--we're on 3.4.5--but when I try to query on the BucketMover component, I get zero results returned.

Re: How do I verify that a configuration change for shortening the time to frozen has gone through?

wwhitener — Wed, 28 Sep 2011 14:44:20 GMT

This one seemed to be universally able to get something--from 4.2.2 and from 3.4.5:

index=_internal source=*splunkd.log bucketmover OR freeze

Not sure why, but putting it in all lower case seems to help it find events.