https://community.splunk.com/t5/Getting-Data-In/How-to-configure-coldToFrozenDir-in-indexes-conf-on-multiple/m-p/200446#M39610 <P>Hi,</P> <P>I needed to know the same answer so I setup Splunk 6.4.8 and tested. To my dismay all buckets from all indexes got to your coldToFrozenDir as db_*.</P> <P>Tried:<BR /> coldToFrozenDir = /media/archive/splunk/$_index_name<BR /> but it created<BR /> /media/archive/splunk/\$_index_name/</P> <P>Lame.</P> Tue, 29 Sep 2020 15:38:15 GMT ephemeric 2020-09-29T15:38:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-coldToFrozenDir-in-indexes-conf-on-multiple/m-p/200445#M39609 <P>So let’s say I have 2 or 3 indexers and I configure the coldToFrozenDir in the indexes.conf…</P> <PRE><CODE>[default] maxWarmDBCount = 200 frozenTimePeriodInSecs = 432000 rotatePeriodInSecs = 30 coldToFrozenDir = "myAmason_server_mount/myfrozenarchive" </CODE></PRE> <P>Do you do this on each of the indexers or should I do something like this</P> <P>Indexer1</P> <PRE><CODE>[default] maxWarmDBCount = 200 frozenTimePeriodInSecs = 432000 rotatePeriodInSecs = 30 coldToFrozenDir = "myAmason_server_mount/myfrozenarchive/index_1" </CODE></PRE> <P>Indexer2</P> <PRE><CODE>[default] maxWarmDBCount = 200 frozenTimePeriodInSecs = 432000 rotatePeriodInSecs = 30 coldToFrozenDir = "myAmason_server_mount/myfrozenarchive/index_2" </CODE></PRE> <P>Indexer3</P> <PRE><CODE>[default] maxWarmDBCount = 200 frozenTimePeriodInSecs = 432000 rotatePeriodInSecs = 30 coldToFrozenDir = "myAmason_server_mount/myfrozenarchive/index_3" </CODE></PRE> <P>I wasn’t sure if the indexer data files would step on each other if I send all the data using coldToFrozenDir option to the same path. i.e "myAmason_server_mount/myfrozenarchive"</P> Tue, 29 Sep 2020 11:37:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-coldToFrozenDir-in-indexes-conf-on-multiple/m-p/200445#M39609 locose 2020-09-29T11:37:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-coldToFrozenDir-in-indexes-conf-on-multiple/m-p/200446#M39610 <P>Hi,</P> <P>I needed to know the same answer so I setup Splunk 6.4.8 and tested. To my dismay all buckets from all indexes got to your coldToFrozenDir as db_*.</P> <P>Tried:<BR /> coldToFrozenDir = /media/archive/splunk/$_index_name<BR /> but it created<BR /> /media/archive/splunk/\$_index_name/</P> <P>Lame.</P> Tue, 29 Sep 2020 15:38:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-coldToFrozenDir-in-indexes-conf-on-multiple/m-p/200446#M39610 ephemeric 2020-09-29T15:38:15Z