topic Re: When does splunk roll data from warm to cold? in Getting Data In

When does splunk roll data from warm to cold?

robertosegantin — Mon, 16 Jul 2018 11:07:08 GMT

On my test environement I configured and index like this:

[prove_di_cold]
homePath = /root/splunk_hot/prove_di_cold/db
coldPath = /root/splunk_cold/prove_di_cold/colddb
thawedPath = /root/splunk_cold/prove_di_cold/thaweddb
maxWarmDBCount=1
maxDataSize = 1000
maxHotSpanSecs = 40
frozenTimePeriodInSecs = 100
rotatePeriodInSecs = 60
bucketRebuildMemoryHint = 0
coldToFrozenDir = /root/splunk_frozen/prove_di_cold
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair = 1
enableTsidxReduction = 0
minHotIdleSecsBeforeForceRoll = 0
rtRouterQueueSize =
rtRouterThreads =
suspendHotRollByDeleteQuery = 0
syncMeta = 1

But splunk never copy any data from hot/warm path to cold or freeze path

Have you got any other information about it?

Thanks

Re: When does splunk roll data from warm to cold?

ddrillic — Mon, 16 Jul 2018 13:20:33 GMT

Weird because you have frozenTimePeriodInSecs = 100

Re: When does splunk roll data from warm to cold?

diogofgm — Tue, 29 Sep 2020 20:27:23 GMT

check with btool which settings are being applied.

./splunk btool indexes list --debug prove_di_cold

Re: When does splunk roll data from warm to cold?

CarsonZa — Mon, 16 Jul 2018 15:27:35 GMT

splunk wont roll the data until the bucket is full. its possible your hot bucket(s) arent full to even roll to warm even if the maxHotSpanSecs = 40 is set.

try setting this maxHotBuckets=x to a lower integer default is 3.

https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Indexesconf