topic Re: Archiving all indexes after 1 year in Getting Data In

Archiving all indexes after 1 year

heathramos — Wed, 02 Aug 2017 14:10:07 GMT

I am trying to set up archiving but I can't seem to get it working.

From the docs I've read, I thought I just need to create a indexes.conf file, place it within system/local and include a line referring to coldToFrozenDir and frozenTimePeriodInSecs .

I tried that for one index and if I restart Splunk, the service won't start back up again unless I delete that file.

How exactly do I set this up?

Re: Archiving all indexes after 1 year

somesoni2 — Wed, 02 Aug 2017 14:34:41 GMT

It may be crashing due to wrong configs (indexes.conf is an important configuration file). Make sure you update the config file correctly. See this links for details on those properties.
https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Setaretirementandarchivingpolicy
https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Automatearchiving

Re: Archiving all indexes after 1 year

heathramos — Wed, 02 Aug 2017 14:41:15 GMT

What should be in that config file?

My file contains the following:

[windows]
coldToFrozenDir = "$SPLUNK_DB\windows\frozendb"
frozenTimePeriodInSecs = 31536000

Re: Archiving all indexes after 1 year

somesoni2 — Wed, 02 Aug 2017 14:48:25 GMT

Try putting hardcoded path (full path) in coldToFrozenDir attribute.

Re: Archiving all indexes after 1 year

s2_splunk — Wed, 02 Aug 2017 14:56:24 GMT

If Splunk doesn't restart because of indexes.conf issues, it should give you some error messages in $SPLUNK_HOME\var\run\splunk\splunkd.log during startup (given your example, I am assuming you are running on Windows)
It would be helpful to see what is being logged.

My best guess is the quotes in your directory, which probably prevent resolution of the env. variable.

Re: Archiving all indexes after 1 year

heathramos — Wed, 02 Aug 2017 15:22:48 GMT

changed the path and restarted splunk

got the following error:

ERROR loader - Problem parsing indexes.conf: Cannot load IndexConfig: Cannot create index 'windows': path of coldToFrozenDir must be absolute ('"d:\Splunk_Archive\windows"')

Re: Archiving all indexes after 1 year

heathramos — Wed, 02 Aug 2017 16:26:30 GMT

looks like getting rid of the quotes completely worked

thanks

Re: Archiving all indexes after 1 year

richgalloway — Wed, 02 Aug 2017 16:47:29 GMT

If your problem is resolved, please accept the answer to help future readers.

Re: Archiving all indexes after 1 year

s2_splunk — Wed, 02 Aug 2017 19:56:03 GMT

Thank you for closing the loop!