topic Re: Reset frozenTimePeriodInSecs in Getting Data In

Reset frozenTimePeriodInSecs

OldManEd — Fri, 11 Apr 2014 15:29:01 GMT

How often does Splunk check for aged data and reclaim disk space? I reset the frozenTimePeriodInSecs on an indexer from 6 years to 5 after checking that we indeed have data that old, but the disk space on the indexer has not changed.

Re: Reset frozenTimePeriodInSecs

martin_mueller — Fri, 11 Apr 2014 15:34:30 GMT

By default Splunk checks every minute, see rotatePeriodInSecs.

Do you have single events that old, or do you have entire buckets that old? The key distinction is that Splunk will only prune whole buckets once the youngest event in that bucket has crossed the frozen threshold.
Use dbinspect to look at your older buckets without mucking about in the file system.

Re: Reset frozenTimePeriodInSecs

OldManEd — Fri, 11 Apr 2014 15:48:50 GMT

Martin,
Thanks for pointing me to "dbinspect". I did not know about that command. As it turns out, it's not a "date" issue that I have, it's a "data size" issue.
~Ed

Re: Reset frozenTimePeriodInSecs

martin_mueller — Fri, 11 Apr 2014 16:46:06 GMT

You can trigger freezing of buckets by data size through fiddling with maxTotalDataSizeMB.

Re: Reset frozenTimePeriodInSecs

yannK — Fri, 11 Apr 2014 16:52:52 GMT

check the timerange of your buckets with dbinspect

To be frozen :
- the bucket cannot be hot
- all the events have to older than the frozenTimePeriodInSecs