https://community.splunk.com/t5/Getting-Data-In/Where-is-the-frozen-data-stored/m-p/335011#M61972 <P>Hi there,</P> <P>Below is sample index configuration:</P> <PRE><CODE>[apache_web] homePath =/splunk/hot/apache_web coldPath = /splunk/cold/apache_web thawedPath = /splunk/thawed/apache_web frozenTimePeriodInSecs = 7776000 maxWarmDBCount = 300 </CODE></PRE> <P>But I was wondering where the data will be stored when it rolled over from cold to frozen when "coldToFrozenDir" is not specified?</P> Wed, 07 Mar 2018 22:07:23 GMT iamlearner123 2018-03-07T22:07:23Z https://community.splunk.com/t5/Getting-Data-In/Where-is-the-frozen-data-stored/m-p/335011#M61972 <P>Hi there,</P> <P>Below is sample index configuration:</P> <PRE><CODE>[apache_web] homePath =/splunk/hot/apache_web coldPath = /splunk/cold/apache_web thawedPath = /splunk/thawed/apache_web frozenTimePeriodInSecs = 7776000 maxWarmDBCount = 300 </CODE></PRE> <P>But I was wondering where the data will be stored when it rolled over from cold to frozen when "coldToFrozenDir" is not specified?</P> Wed, 07 Mar 2018 22:07:23 GMT https://community.splunk.com/t5/Getting-Data-In/Where-is-the-frozen-data-stored/m-p/335011#M61972 iamlearner123 2018-03-07T22:07:23Z https://community.splunk.com/t5/Getting-Data-In/Where-is-the-frozen-data-stored/m-p/335012#M61973 <P>Hi iamlearner123,</P> <P>from the docs <A href="http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstorage">http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstorage</A></P> <PRE><CODE>coldToFrozenDir If you don't set either this attribute or coldToFrozenScript, the indexer will just log the bucket's directory name and then delete it once it rolls to frozen. </CODE></PRE> <P>Long story short, there is no default directory for frozen - it will be deleted.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Wed, 07 Mar 2018 22:35:58 GMT https://community.splunk.com/t5/Getting-Data-In/Where-is-the-frozen-data-stored/m-p/335012#M61973 MuS 2018-03-07T22:35:58Z