topic Re: / opt / splunk / var / lib / splunk / cold in Knowledge Management

/ opt / splunk / var / lib / splunk / cold

isabelcarvajal — Mon, 18 Jun 2018 13:59:52 GMT

Hello

I like you help with validate what contain the Filesystem / opt / splunk / var / lib / splunk / cold, indicator wha it is used 100%.

thanks.

PowerPacked — Tue, 29 Sep 2020 20:04:51 GMT

/ opt / splunk / var / lib / splunk -- filesystem holds data for all indexes like _internal, _introspection,_audit, main.

in each of these indexes, the data again is arranged based on the age ----- Hot, warm, cold, thawed

db folder ----- hot &warm data
colddb ----- cold data
thaweddb ----- restore frozen data which can be searched.

& aging of the data can be explained in this doc.

thanks

isabelcarvajal — Mon, 18 Jun 2018 22:05:40 GMT

Hello, I have one Question.

If this file system can be affected the operation of splunk?

Thanks for your answer

PowerPacked — Tue, 19 Jun 2018 02:56:48 GMT

what do you mean by affected ?

isabelcarvajal — Tue, 19 Jun 2018 12:02:57 GMT

Hello

If / opt / splunk / var / lib / splunk / cold, the indicator is used 100%, can it cause problems in some splunk functionality?

thanks