topic Re: Why is the frozen data not deleted automatically? in Getting Data In

Why is the frozen data not deleted automatically?

knarayana — Mon, 14 May 2018 23:50:12 GMT

I have these settings for my index

maxTotalDataSizeMB = 100000
coldPath = C:/colddb
homePath = C:/db
coldToFrozenDir = C:/frozendb
thawedPath = C:/thaweddb

Data is not deleted as it moves to forzendb.
forzendb is now 128GB.

Not sure why this is not working as expected.

Thanks

Re: Why is the frozen data not deleted automatically?

HiroshiSatoh — Tue, 15 May 2018 00:40:30 GMT

The forzen data is not deleted automatically. It is outside the management of splunk. If deletion is necessary, it is necessary to delete it using a shell etc.

Re: Why is the frozen data not deleted automatically?

datasearchninja — Wed, 16 May 2018 03:58:28 GMT

If you want to delete when freezing, do not set a coldToFrozenDir, and then data will not be moved to the frozen directory, but be deleted instead

See https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf .