topic Re: Retention doesn't work - what's wrong ? in Getting Data In

Retention doesn't work - what's wrong ?

mikesr — Thu, 10 Jul 2014 10:20:23 GMT

Hi,

we configured retention policy based on the below parameters. However it doesn't work. There is no clue in the logs either.
The Splunk is running on Windows Server 2012. User of the suplunkd proces has Full Control rights to the archive DIR.
When the archive DIR was missing the frozen data were deleted along the frozenTimePeriodInSecs parameter. After adding the coldToFrozenDir parameter data are neither copied to the DIR nor deleted.
Can anyone help please.

[main]

frozenTimePeriodInSecs = 15552000

coldToFrozenDir = D:\SplunkArchive

Thanx
Roman

Re: Retention doesn't work - what's wrong ?

datasearchninja — Thu, 10 Jul 2014 15:37:09 GMT

Are you sure that you have data that is a candidate for archive? Data is only frozen when all events in the bucket are older than the frozenTimePeriodInSecs.

Re: Retention doesn't work - what's wrong ?

mikesr — Fri, 11 Jul 2014 09:37:26 GMT

Not sure at all 😉 Looking that colddb dir is empty as well ... Any clue ?

Re: Retention doesn't work - what's wrong ?

datasearchninja — Sun, 13 Jul 2014 23:51:00 GMT

Try a search like this to list the times when you would expect buckets to roll to frozen (Replacing with the index you are interested in, and the timetofrozen amount):

| dbinspect index=main | search state!="hot" | table splunk_server bucketId endEpoch | eval frozenTimePeriodInSecs = "15552000" | eval frozentime=endEpoch+frozenTimePeriodInSecs | sort frozentime | convert TIMEFORMAT="%Y-%m-%d %H:%M:%S" ctime(frozentime) as frozentime

Re: Retention doesn't work - what's wrong ?

mikesr — Fri, 18 Jul 2014 04:52:08 GMT

This works prety well. I can see when the next bucket will be rolled over. Currently some data has been moved to the archive.

Thanks for your help.