topic Re: Where are my archived files getting saved? in Getting Data In

Where are my archived files getting saved?

seema2502 — Thu, 16 Oct 2014 06:32:05 GMT

Hi Team,

i want to know where my archived files are getting saved as in my indexes.conf file "coldToFrozenDir = ".
currently we are keeping logs only for 30 days, but the team who is using Splunk need logs for at least 60 days, so i need to analyze how much data we had last month so that we can check for disk space and rest all configuration.

Thanks,
Seema

Re: Where are my archived files getting saved?

MuS — Thu, 16 Oct 2014 06:42:44 GMT

Hi seema2502,

from the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/Automatearchiving

Caution: By default, the indexer deletes all frozen data. It removes the data from the index at the moment it becomes frozen. If you need to keep the data around, you must configure the indexer to archive the data before removing it. You do this by either setting the coldToFrozenDir attribute or specifying a valid coldToFrozenScript in indexes.conf.

You can verify with this command (on *nix) $SPLUNK_HOME/bin/splunk cmd btool indexes list | grep coldToFrozenDir if any valid directory is set or not. If not your frozen events are gone.

cheers, MuS

Re: Where are my archived files getting saved?

seema2502 — Thu, 16 Oct 2014 06:47:28 GMT

Hi Mus,

Thanks a lot for your swift response. As we have not set any specific path for coldToFrozenDir hence Splunk might have removed all the frozen files.
Regards,
Seema

Re: Where are my archived files getting saved?

MuS — Thu, 16 Oct 2014 07:02:55 GMT

Indeed, no directory set = frozen events removed. Please mark this as answered in this case, thx