https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192202#M38337 <P>So wait, what? </P> <OL> <LI>You have 8 servers mounted to a SINGLE 11TB NFS Mount? </LI> <LI>What are the server specs of the indexers? </LI> <LI>How are you transitioning from cold to frozen? Homebrew script? Shuttl? </LI> </OL> Mon, 23 Mar 2015 18:54:19 GMT alacercogitatus 2015-03-23T18:54:19Z https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192201#M38336 <P>Hi,</P> <P>In my environment we have so many index servers Eg:8 idx servers.<BR /> All servers are mounted with one nfs volume called /splunk which has 11TB.<BR /> /splunk mount point contain hot ,cold, warm and frozen.</P> <P>No as we have some space issue, we need to separate frozen from the /splunk volume.<BR /> We have got one new nfs volume with 10TB for /splunk/frozen. <BR /> Now the query is if I need to separate the frozen from the old volume, i can mount it separately and copy old data.But do i need to make any changes in any of the splunk configuration?</P> <P>Please suggest here.</P> <P>Regards,<BR /> Unni TN</P> Mon, 23 Mar 2015 12:42:43 GMT https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192201#M38336 splunkdeploy 2015-03-23T12:42:43Z https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192202#M38337 <P>So wait, what? </P> <OL> <LI>You have 8 servers mounted to a SINGLE 11TB NFS Mount? </LI> <LI>What are the server specs of the indexers? </LI> <LI>How are you transitioning from cold to frozen? Homebrew script? Shuttl? </LI> </OL> Mon, 23 Mar 2015 18:54:19 GMT https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192202#M38337 alacercogitatus 2015-03-23T18:54:19Z https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192203#M38338 <P>FYR, Answer for 3 can be found by checking the value of attribute "coldToFrozenDir" OR "coldToFrozenScript" from indexes.conf file on Indexer server.</P> Mon, 23 Mar 2015 19:27:12 GMT https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192203#M38338 somesoni2 2015-03-23T19:27:12Z https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192204#M38339 <P>You can use the coldtofrozendir setup, in indexes.conf</P> <P>To avoid duplicates buckets, I recommend to create a new destination frozen folder for each pair or indexer/index.<BR /> It will also make it easier to restore.<BR /> (do not dump all in the same folder, it will be a nightmare)</P> Mon, 23 Mar 2015 20:12:41 GMT https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192204#M38339 yannK 2015-03-23T20:12:41Z https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192205#M38340 <P>Hi,</P> <P>1.You have 8 servers mounted to a SINGLE 11TB NFS Mount?<BR /> yes, I have 8 diff. servers mounted to 11TB. 11TB mount name in /splunk and it has hot , cold and frozen.<BR /> Inside /splunk/frozen i have diff. 8 server name.</P> <P>2.What are the server specs of the indexers?<BR /> All 8 servers have, 8 CPU and 16GB Memory.</P> <OL> <LI>How are you transitioning from cold to frozen? Homebrew script? Shuttl? When i have checked indexes.conf file i could see frozen transition has designed as</LI> </OL> <P>coldToFrozenDir = /splunk/frozen/$HOSTNAME</P> <P>Regards,<BR /> Unni TN</P> Tue, 24 Mar 2015 12:06:48 GMT https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192205#M38340 splunkdeploy 2015-03-24T12:06:48Z https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192206#M38341 <P>use a folder per index and indexer.<BR /> coldToFrozenDir = /splunk/frozen/servername/indexname</P> Tue, 24 Mar 2015 16:01:12 GMT https://community.splunk.com/t5/Getting-Data-In/splitting-splunk-frozen-volume/m-p/192206#M38341 yannK 2015-03-24T16:01:12Z